Secure element, device and method for managing non-volatile memory

Abstract

To provide a secure element capable of extending the memory life of a nonvolatile memory by a relatively simple process that does not become complex, a device built with the secure element, and a managing method of the nonvolatile memory.SOLUTION: A secure element includes: a nonvolatile memory 104 provided with a spare region utilized to substitute a page 13; and memory managing means 11 for managing entry information on the page 13 associated with a logical page number so as to correspond to the logical page number. The memory managing means 11 executes processes of recording the number of updates of the page 13 in which data is written every time a writing process of data is executed, copying the page data on the page 13 in which the data is written in the page 13 within the spare region when the number of updates reaches a threshold, and then rewriting the entry information associated with the logical page number corresponding to the page 13 in which the data is written to the entry information on the page within the spare region in which the page data is copied.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to a technique for extending the memory life of a non-volatile memory in a secure element. [Background technology]

[0002] Secure elements, which are semiconductor products with strong tamper resistance against external analysis attacks, are installed in various devices (e.g., IC cards). The main use of devices equipped with secure elements is for security purposes (e.g., financial settlement purposes).

[0003] A secure element implemented in a device used for security purposes has an electrically rewritable non-volatile memory as a memory for storing data. Hereinafter, non-volatile memory means an electrically rewritable non-volatile memory.

[0004] The non-volatile memory in a secure element is managed in units called pages. In non-volatile memory, data is erased in units of pages. For this reason, when writing data to a page of non-volatile memory that stores data, the page data (meaning the entire data of the page) of the page to which the data is to be written must first be erased, and then the page data with the data written to a specified address must be written to the page from which the page data was erased.

[0005] Due to the structure of the recording element that constitutes the nonvolatile memory, there is an upper limit to the number of times the nonvolatile memory can be updated (erased). The update limit set for the nonvolatile memory varies depending on the type of nonvolatile memory. For example, the update limit for nonvolatile memory is 100,000 times.

[0006] In recent years, the size of data stored in secure elements has increased, leading to an increase in the capacity of the nonvolatile memory provided in the secure elements, and the page size of the nonvolatile memory also tends to increase.

[0007] As the page size increases, there are advantages such as fewer pages to which data can be written when handling large data. However, when handling small data, the amount of data contained in one page increases, and if multiple pieces of data that are frequently rewritten are stored in one page, the number of updates to this page increases, resulting in a problem of shortening the memory lifespan of the non-volatile memory. Therefore, it is necessary to devise a way to prevent the memory lifespan of the non-volatile memory from being shortened even when data that is frequently rewritten exists.

[0008] Wear leveling is a common technique for extending the memory lifespan of non-volatile memory (see, for example, Patent Document 1). Wear leveling is a technique that distributes memory elements that are rewritten so that they are not biased toward specific ones, thereby averaging out the wear of memory elements in the non-volatile memory as a whole, even if specific data is repeatedly rewritten. [Prior art documents] [Patent documents]

[0009] [Patent Document 1] JP 2019-128905 A Summary of the Invention [Problem to be solved by the invention]

[0010] When the wear leveling process is used to extend the memory life of nonvolatile memory, the process of extending the memory life of nonvolatile memory becomes complicated. In particular, when multiple pieces of small data that are frequently rewritten are scattered across one page, the wear leveling process must be performed taking into account each piece of data, making the process of extending the memory life of nonvolatile memory more complicated.

[0011] Therefore, an object of the present invention is to extend the memory life of a non-volatile memory implemented in a secure element using relatively simple processing that is not complicated. [Means for solving the problem]

[0012] The first invention for solving the above-mentioned problems is a secure element comprising an electrically rewritable non-volatile memory having a spare area to be used as a replacement for a page storing data, and a memory management means for managing entry information of a page corresponding to the logical page number in association with a logical page number, wherein the memory management means records the number of updates of the page to which data is written each time a data write process is executed, and when the number of updates of the page to which data is written reaches a threshold value, copies the page data of the page to which data is written to one page included in the spare area, and executes a process of rewriting the entry information associated with the logical page number to which the page to which data is written corresponds to the entry information of the page in the spare area to which the page data was copied.

[0013] Furthermore, a second invention is a device that implements the secure element described in the first invention.

[0014] Furthermore, a third invention is a non-volatile memory management method for a secure element, characterized in that a spare area to be used as a replacement for a page storing data is provided in an electrically rewritable non-volatile memory, and a memory management means for managing entry information of a page associated with a logical page number and corresponding to the logical page number records the number of updates of the page to which data is written each time a data write process is executed, and when the number of updates of the page to which data is written reaches a threshold value, the memory management means executes a step of copying page data of the page to which data is written to one page included in the spare area, and rewriting entry information associated with the logical page number to which the page to which data is written corresponds to entry information of the page of the spare area to which the page data was copied. Effect of the Invention

[0015] In the present invention, the memory life of a non-volatile memory can be extended by a relatively simple process of simply replacing a page of the non-volatile memory whose update count is approaching its update limit with another page. [Brief description of the drawings]

[0016] [Figure 1] FIG. 1 is a diagram illustrating an example of a device equipped with a secure element. [Diagram 2] FIG. 2 is a diagram for explaining hardware included in a secure element. [Diagram 3] FIG. 2 is a diagram for explaining the configuration of a secure element. [Figure 4] FIG. 2 is a diagram illustrating a structure of a nonvolatile memory. [Diagram 5] FIG. 2 is a diagram for explaining a page table. [Figure 6] FIG. 4 is a diagram for explaining the operation of a memory management means included in the secure element. [Figure 7] 11A and 11B are diagrams illustrating a process of replacing a page whose update count has reached a threshold value. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] Hereinafter, an embodiment of the present invention will be described. This embodiment is for the purpose of facilitating understanding of the present invention, and the present invention is not limited to this embodiment. Furthermore, unless otherwise specified, the drawings are schematic diagrams drawn for the purpose of facilitating understanding of the present invention.

[0018] Fig. 1 is a diagram for explaining an example of a device 2 equipped with a secure element 1. In Fig. 1, the device 2 equipped with the secure element 1 is illustrated as a contact type IC card that communicates with an external terminal by contact communication conforming to ISO7816.

[0019] 1, device 2 is shaped like a credit card, but the shape of device 2 equipped with secure element 1 is not limited to that of a credit card. Device 2 equipped with secure element 1 may be a SIM (Subscriber Identity Module) attached to a smartphone or the like, or an eSIM (embedded Subscriber Identity Module) mounted on a board of a smartphone or the like.

[0020] In the device 2 shown in Fig. 1, the secure element 1 is resin molded on the back side of an external terminal. The secure element 1 communicates by contact with an external device (e.g., a reader / writer) not shown in the figure via the external terminal 20. Note that the communication method supported by the secure element 1 is not limited to contact communication compliant with ISO7816. The communication method supported by the secure element 1 may be contactless communication compliant with ISO14443, or a communication method used inside a computer (e.g., SPI, Serial Peripheral Interface).

[0021] 2 is a diagram for explaining the hardware included in the secure element 1. The secure element 1 according to this embodiment includes, as hardware, a contact communication interface 101, a CPU 100 (Central Processing Unit), a RAM 102 (Random Access Memory), a ROM 103 (Read Only Memory), a non-volatile memory 104, a coprocessor 105, a random number generator 106 (RNG), and a power supply circuit 107. Naturally, the circuits integrated in the secure element 1 are not limited to these circuits.

[0022] In this embodiment, the CPU 100 of the secure element 1 is a circuit that interprets program codes stored in a memory and executes a predetermined process. The power supply circuit 107 is a circuit that connects to the external terminal 20 (VCC terminal) on the surface of the device 2 and supplies power supplied from the external terminal to other circuits (e.g., the CPU 100). The contact communication interface 101 is a circuit that connects to the external terminal 20 (I / O terminal) on the surface of the device 2 and performs contact communication with the external terminal. The coprocessor 105 is a circuit configured to be able to process cryptographic operations using an encryption key at high speed. The random number generator 106 is a circuit that generates random numbers.

[0023] The RAM 102, ROM 103, and non-volatile memory 104 are memories included in the secure element 1. The RAM 102 is an electrically rewritable volatile memory. The ROM 103 is a read-only memory that cannot be electrically rewritable. The non-volatile memory 104 is an electrically rewritable non-volatile memory.

[0024] 3 is a diagram explaining the configuration of the secure element 1. The non-volatile memory 104 provided in the secure element 1 is a memory to which data is written. An operating system 10 (hereinafter, referred to as "OS 10." OS is an abbreviation for Operating System) implemented in the secure element 1 has a function of managing the non-volatile memory 104.

[0025] The application 12 has a command that requires a process of writing data to the non-volatile memory 104. This command includes not only write-type commands but also authentication-type commands. The authentication-type commands require at least a retry counter that counts the number of times authentication is interrupted or fails. The retry counter is data stored in the non-volatile memory 104. Each time an authentication-type command is executed, the value of the retry counter stored in the non-volatile memory 104 is rewritten to a value subtracted by one, and when authentication corresponding to the authentication-type command is successful, the value of the retry counter stored in the non-volatile memory 104 is rewritten to the maximum value of the retry counter.

[0026] 4 is a diagram for explaining the structure of the non-volatile memory 104. As shown in FIG. 4, the non-volatile memory 104 provided in the secure element 1 is divided into units called pages 13 and managed by the OS 10 implemented in the secure element 1. Specifically, a page 13 is a continuous address range of a predetermined page size. In the case of a non-volatile memory 104 with a relatively small capacity, the page size is about several tens of bytes, but in the case of a non-volatile memory 104 with a relatively large capacity, the page size is 128 bytes, 256 bytes, 512 bytes, or the like.

[0027] The non-volatile memory 104 provided in the secure element 1 includes a data storage area 1040 and a spare area 1043. The data storage area 1040 includes an OS area 1041 which is an area allocated to the OS 10, and an application area 1042 which is an area allocated to an application 12 implemented in the secure element 1. Pages 13 included in the OS area 1041 store at least data used by the OS 10. The main body of the program code of the OS 10 is stored in the ROM 103. Pages 13 included in the application area 1042 store the program code of the application 12 and the data used by the application 12.

[0028] The spare area 1043 is an area for securing pages 13 to be used as replacements for pages 13 contained in the data storage area 1040. Page 13 of the data storage area 1040 to be replaced with page 13 in the spare area 1043 is page 13 whose number of updates has approached the update limit of the non-volatile memory 104. Note that page 13 in the spare area 1043 used to replace page 13 in the data storage area 1040 is migrated from the spare area 1043 to the data storage area 1040. When one page 13 in the spare area 1043 is used for replacement, the number of pages contained in the spare area 1043 decreases by one, but the number of pages contained in the data storage area 1040 remains unchanged.

[0029] The OS 10 implemented in the secure element 1 includes a memory management means 11 as a function for managing the non-volatile memory 104 .

[0030] The memory management means 11 has a page table 130 which serves as a data table for managing pages 13 of the non-volatile memory 104 implemented in the secure element 1 and which lists logical page numbers and entry information relating to pages 13 of the non-volatile memory 104 corresponding to these logical page numbers.

[0031] The logical page number is a logical page number of the non-volatile memory 104, and is a page number used by a computer program to specify an address. By using the logical page number to manage the pages 13 of the non-volatile memory 104, the computer program can access specific data without being aware of the physical address of the data that the computer program accesses.

[0032] Fig. 5 is a diagram illustrating the page table 130. The page table 130 has records according to the total number of logical page numbers. In this embodiment, the total number of logical page numbers is the total number of pages in the non-volatile memory 104. In Fig. 5, the logical page numbers are arranged in descending order. In one record, the logical page number corresponding to the record, the page attribute to be associated with the logical page number, and the entry information of the page 13 to be associated with the logical page number are recorded.

[0033] The page attribute is information indicating the attribute of the page 13 of the non-volatile memory 104 that corresponds to the logical page number. In this embodiment, the page attribute is information indicating either the data storage area 1040 or the spare area 1043. The number of logical page numbers for which the page attribute is set to the spare area 1043 is determined in advance. In FIG. 5, the logical page numbers for which the page attribute is set to the spare area 1043 are arranged at the bottom end of the page table 130. In FIG. 5, the page attributes of all logical page numbers for which the page attribute is not set to the spare area 1043 are set to the data storage area 1040.

[0034] The entry information of page 13 of non-volatile memory 104 includes information for accessing page 13 of non-volatile memory 104. The entry information in this embodiment includes the start address of page 13. The start address is an address in non-volatile memory 104 that is the beginning of the area corresponding to page 13. By using the entry information recorded in page table 130, it is possible to access page 13 of non-volatile memory 104 that corresponds to the logical page number.

[0035] The memory management means 11 is configured to be able to manage the update count of a page 13 for each page 13. The update count of a page 13 can be stored in the page table 130, but if the update count of a page 13 is stored in the page table 130, the update count of the page 13 storing the page table 130 will be the highest. This is because, regardless of the page 13 to which data is written, it is always necessary to update the page 13 storing the page table 130 each time a data write process is executed.

[0036] Therefore, in this embodiment, the number of updates of page 13 is stored in page management information 131, which is data stored for each page 13. In addition to the number of updates, the page management information 131 can contain other data related to the management of the page 13. For example, an error detection code for the page data can be contained in the page management information 131. Since data is written on a page-by-page basis, when data is written to page 13, if the number of updates contained in the page management information 131 of the page 13 to which the data is written is also updated at the same time, it becomes unnecessary to update the page 13 just to record the number of updates of the page 13.

[0037] The reason why the memory management means 11 according to this embodiment manages the update count of the page 13 for each page 13 is so that the page 13 whose update count is approaching the update limit can be replaced by the page 13 in the spare area 1043. By providing the memory management means 11 with this function, the memory life of the nonvolatile memory 104 can be extended by a relatively simple process of simply replacing the page 13 whose update count is approaching the update limit with another page 13. Also, by determining the initial value of the number of pages to be included in the spare area 1043 according to the number of pages 13 that are frequently rewritten, the number of pages of the nonvolatile memory 104 required to extend the memory life of the nonvolatile memory 104 can be reduced.

[0038] From here, the operation of the memory management means 11 included in the secure element 1 according to this embodiment will be described in detail. Fig. 6 is a diagram explaining the operation of the memory management means 11 included in the secure element 1. The explanation of Fig. 6 also includes an explanation of the non-volatile memory management method according to the present invention.

[0039] 6, the memory management means 11 receives a request to write data to the non-volatile memory 104. A computer program such as an application 12 issues a request to the memory management means 11 to write data to the non-volatile memory 104. In the request to write data to the non-volatile memory 104, the data to be written to the non-volatile memory 104 and the destination address to which this data is to be written are passed to the memory management means 11. Note that at least the logical page number is used to specify the destination address. Specifically, the address is described by the logical page number and an offset within the page.

[0040] In step S2 of Fig. 6, the memory management means 11 executes a process of writing the data included in the data write request from the write destination address included in the data write request. In step S3 of Fig. 6, the memory management means 11 executes a process of recording the number of updates of page 13 of the non-volatile memory 104 to which the data has been written (which becomes page 13 included in the data storage area 1040). In step S4 of Fig. 6, the memory management means 11 checks the number of updates of page 13 of the non-volatile memory 104 to which the data has been written. If the number of updates of page 13 of the non-volatile memory 104 to which the data has been written does not reach the threshold value, the memory management means 11 ends the procedure of Fig. 6 without executing a process related to replacement of page 13 of the non-volatile memory 104.

[0041] When the number of updates of the page 13 of the non-volatile memory 104 in which the data has been written reaches a threshold value, the memory management means 11 executes a process of substituting the page 13 of the non-volatile memory 104 in which the data has been written.

[0042] When replacing page 13 of non-volatile memory 104 whose number of updates has reached a threshold, first, in step S5 of Figure 6, the memory management means 11 selects one logical page number from the page table 130 whose page attribute is spare area 1043 and which is associated with the entry information of page 13 in spare area 1043.

[0043] 6, the memory management means 11 initializes the update count of the page 13 of the non-volatile memory 104 whose update count has reached the threshold value. Note that the page 13 of the non-volatile memory 104 whose update count has reached the threshold value becomes the page 13 corresponding to the logical page number included in the write destination address of the data write request.

[0044] Next, in step S7 of FIG. 6, the memory management means 11 executes a process of replacing page 13 of the non-volatile memory 104, whose number of updates has reached a threshold, with page 13 of the spare area 1043 corresponding to the logical page number selected in step S5 of FIG. 6, and the procedure of FIG. 6 is then terminated.

[0045] 6, the specific content of the process of recording the update count of page 13 differs depending on the recording location of the update count of page 13. When the update count of page 13 is recorded in page management information 131, the update count of page management information 131 is also updated together with the writing of data.

[0046] 6, the method of determining the threshold value used to judge the number of updates can be arbitrarily determined. For example, the threshold value can be set to a value that is 95% of the limit number of updates set in the non-volatile memory 104.

[0047] 7 is a diagram for explaining the process of replacing page 13 whose update count has reached a threshold value. In step S7 of FIG. 6, the process of replacing page 13 in data storage area 1040 whose update count has reached a threshold value with page 13 in spare area 1043 is the process illustrated in FIG.

[0048] In step S10 of Fig. 7, the memory management means 11 copies the page data of page 13 whose update count has reached the threshold to page 13 of spare area 1043 corresponding to the logical page number selected in step S5 of Fig. 6. The entry information for accessing page 13 whose update count has reached the threshold is the entry information associated with the logical page number included in the write destination address of the data write request in page table 130. The entry information for accessing page 13 in spare area 1043 to be used as a substitute is the entry information associated with the logical page number selected in step S5 of Fig. 6.

[0049] Next, in step S11 of Fig. 7, the memory management means 11 rewrites the entry information in the page table 130 associated with the logical page number corresponding to the page 13 whose update count has reached the threshold to the entry information associated with the logical page number selected in step S5 of Fig. 6, i.e., the entry information of the page 13 in the spare area 1043 to which the page data has been copied. As a result, the page 13 in the non-volatile memory 104 whose update count has reached the threshold is replaced with the page 13 in the spare area 1043 corresponding to the logical page number selected in step S5 of Fig. 6. Also, since the entry information of the page 13 whose update count has reached the threshold is erased from the page table 130, the page 13 whose update count has reached the threshold cannot be used.

[0050] Next, in step S12 of Fig. 7, the memory management means 11 erases the entry information of the logical page number corresponding to page 13 of the spare area 1043 used to replace page 13 whose update count has reached the threshold value, i.e., the entry information associated with the logical page number selected in step S5 of Fig. 6, and the procedure of Fig. 7 ends. By erasing the entry information associated with the logical page number selected in step S5 of Fig. 6, page 13 of the spare area 1043 used to replace page 13 of the data storage area 1040 cannot be used to replace page 13. [Explanation of symbols]

[0051] 1. Secure Element 10. Operating Systems 11 Memory Management Methods 12 Applications 104 Non-volatile memory 1040 Data storage area 1043 Spare Area Page 13 130 Page Table 1300 Entry Information Page 131 Management Information

Claims

1. The memory management unit is provided with an electrically rewritable non-volatile memory having a spare area to be used as a replacement for a page storing data, and a memory management unit that manages entry information of a page corresponding to the logical page number in association with the logical page number, the memory management means records the number of updates of the page into which the data is written each time a data write process is executed, and when the number of updates of the page into which the data is written reaches a threshold value, executes a process of copying page data of the page into which the data is written to one page included in the spare area, and rewriting entry information associated with a logical page number corresponding to the page into which the data is written to entry information of the page in the spare area into which the page data is copied; A secure element characterized by:

2. A device implementing the secure element according to claim 1.

3. a step of providing a spare area used as a replacement for a page storing data in an electrically rewritable non-volatile memory, a memory management means for managing entry information of a page corresponding to the logical page number in association with a logical page number, recording the number of updates of the page to which data has been written each time a data write process is executed, and when the number of updates of the page to which data has been written reaches a threshold value, the memory management means executes a step of copying page data of the page to which data has been written to one page included in the spare area, and rewriting entry information associated with the logical page number to which the page to which data has been written corresponds to entry information of the page in the spare area to which the page data has been copied; 13. A method for managing non-volatile memory of a secure element, comprising:

Images