JP4734582B2 - Non-volatile memory data update method, control device, and data update program - Google Patents

Description

  The present invention relates to a data update method for a nonvolatile memory, a control device, and a data update program for a nonvolatile memory, and more particularly to a data that can prevent unintended data erasure and data tampering.

  Conventionally, non-volatile memory such as EEPROM (Electrically Erasable Programmable Read Only Memory) or flash memory can be used as a memory that can retain stored contents even when power is cut off and that can be electrically rewritten by a program. Memory is used. A method for updating data in the nonvolatile memory will be described below with reference to FIG.

  FIG. 5 is a flowchart showing a flow of a method for updating data in the nonvolatile memory.

  In FIG. 5, first, a working area mapped to a volatile memory such as a RAM (Random Access Memory) is prepared, and a sector to which data that needs to be updated is copied and temporarily saved in the working area (step). S101). Then, an update operation (for example, a bit shift process or an AND process by software) is performed on data that needs to be updated in the working area (step S102). Then, in the nonvolatile memory, the sector to which the data that needs to be updated belongs is erased (step S103). Finally, the updated data on the working area described above is written in the sector erased in step S103 (step S104), and the data update is completed.

  Here, in such a data update method of the nonvolatile memory, a data update method to which a protection function for preventing unintended data erasure and data tampering is added has been proposed (see, for example, Patent Document 1). According to the invention described in Patent Document 1, a plurality of write protection cancellation codes are provided to the flash ROM using the write protection control means for setting or canceling the state in which writing to the flash ROM is prohibited (write protection state). Are written with a predetermined delay time interposed. As a result, it is possible to distinguish between a case where the program is operating normally and a case where the program runs away and a write protect code is issued, and thus erroneous writing can be prevented.

JP 2003-132687 A (FIG. 2)

  However, in the invention described in Patent Document 1 described above, if the flash ROM model or manufacturer is different, not only the method (software) for setting or canceling the write protect state is changed, but the write protect state may be set or The write protection control means (hardware) to be released is also forced to change, and lacks versatility. As a result, regarding the data update of the nonvolatile memory, the cost of measures for preventing unintended data erasure and data tampering is increased, and the practicality is also lacking.

  The present invention has been made in view of the above points, and its purpose is to provide versatility capable of preventing unintentional data erasure and data tampering with any model and any manufacturer's nonvolatile memory. Another object of the present invention is to provide a non-volatile memory data update method, a control device, and a non-volatile memory data update program that also have practicality that can be realized inexpensively and easily.

  In order to solve the above problems, the present invention provides the following.

(1) A non-volatile memory including a sector erasing process in which a CPU mounted on a lower-level device uses a storage unit that stores a predetermined pattern based on a command from the higher-level device to erase a sector to which data that needs to be updated belongs In the data update method, the sector erasing step is divided into a plurality of sector erasing procedures, and the CPU executes the truth of the predetermined pattern before at least the last sector erasing procedure among the plurality of sector erasing procedures. A non-volatile memory data update method, comprising: a pattern authenticity determination step for determining false, wherein the sector is erased when a determination result by the pattern authenticity determination step is true.

  According to the present invention, a sector for erasing a sector to which data to be updated belongs by using a storage unit that stores a predetermined pattern based on a command from a higher-level device such as a host computer, for example, in a data update method for a nonvolatile memory An erasing process is included. In addition, the sector erasing step is divided into a plurality of sector erasing procedures, and includes a pattern authenticity determining step for determining the authenticity of a predetermined pattern before and after the sector erasing procedure. Since the sector is erased when the determination result by the pattern authenticity determination process is true, whether or not the sector can be erased by using the determination result by the process at the application level as the pattern authenticity determination process as a trigger. Will be determined.

  Therefore, it is possible to prevent unintended data erasure and data tampering with any model and non-volatile memory of any manufacturer. Even if an accidental program runaway or the like occurs, the predetermined pattern for which the pattern authenticity determination means determines true / false is not true unless it is stored in the storage means based on a command from the host device. Therefore, erroneous erasure and erroneous writing can be prevented, and as a result, the reliability of the data update method of the nonvolatile memory can be improved. Furthermore, since the present invention can realize a protection function at the application level, it is possible to prevent unintended data erasure and the like at low cost and simply.

Before Symbol sector erase process, prior to the last sector erase procedure of the plurality of sector erase procedure, it comprising said pattern authenticity determination process.

  According to the present invention, since the pattern authenticity determination step is included before the last sector erase procedure among the plurality of sector erase procedures, the protection function at the application level can be performed with a minimum processing load. Can be realized.

(2) A plurality of the predetermined patterns are stored in each storage area of the storage means, the pattern authenticity determining step determines the authenticity of the predetermined pattern a plurality of times, and the sector erasing step includes the pattern authenticity The data update method for a nonvolatile memory according to (1) , wherein the sector is erased when all the determination results in the false determination step are true.

  According to the present invention, the pattern authenticity determination step determines whether or not each of the predetermined patterns stored in each storage area of the storage means is true, and erases the sector when all the determination results are true. Therefore, it is possible to superimpose a protection function at the application level, and more reliably prevent unintended data erasure and data tampering.

(3) In the case where a plurality of the predetermined patterns are stored in each storage area of the storage means, when the predetermined pattern stored immediately before is not normally stored, a predetermined abnormality instead of the predetermined pattern The data update method for a nonvolatile memory according to (2), wherein a plurality of patterns are stored in each storage area of the storage means.

  According to the present invention, when a plurality of predetermined patterns are sequentially stored in each storage area of the storage means, when the predetermined pattern stored immediately before is not normally stored, a predetermined pattern is determined instead of the predetermined pattern. Since a plurality of abnormal patterns (for example, zero) are stored in each storage area of the storage unit, whether or not an incorrect pattern is stored even when the storage unit stores a predetermined pattern based on a command from the host device. It is possible to check whether or not, and as a result, the reliability of the data update method of the nonvolatile memory can be further improved.

(4) In the case where a plurality of the predetermined patterns are stored in each storage area of the storage means, when all of the predetermined patterns are not stored within a predetermined time, a predetermined abnormal pattern instead of the predetermined pattern Is stored in each storage area of the storage means, the data update method for a nonvolatile memory according to (2) or (3) .

  According to the present invention, when a plurality of predetermined patterns are stored in order in each storage area of the storage means, when all the predetermined patterns are not stored within a predetermined time, a predetermined abnormal pattern is used instead of the predetermined pattern. (E.g. zero) is stored in each storage area of the storage means, so even at the stage of storing the predetermined pattern based on the command from the host device, due to accidental program runaway, etc. It is possible to check whether or not an erroneous pattern is stored, and as a result, the reliability of the data update method of the nonvolatile memory can be further improved.

(5) A non-volatile memory control device comprising control means for executing the non-volatile memory data update method according to any one of (1) to (4) .

  According to the present invention, by using a non-volatile memory control device including a control means for executing the above-described non-volatile memory data update method, any model or any manufacturer's non-volatile memory can be used. Unnecessary data erasure and data tampering can be prevented.

(7) A non-volatile memory in which a CPU mounted in a lower apparatus executes a sector erasing process for erasing a sector to which data that needs to be updated belongs, using a storage unit that stores a predetermined pattern based on a command from the upper apparatus The sector erasing step is divided into a plurality of sector erasing procedures, and at least before the last sector erasing procedure among the plurality of sector erasing procedures, the CPU A non-volatile memory data update program comprising: a pattern authenticity determining step for determining authenticity; and erasing the sector when a determination result by the pattern authenticity determining step is true.

  According to the present invention, there is provided a data update program for a non-volatile memory including a sector erase step divided into a plurality of sector erase procedures, based on a command from a host device at least one of before and after the sector erase procedure. A non-volatile memory that includes a pattern authenticity determination step for determining the authenticity of a predetermined pattern stored in the storage means, and that erases a sector when the determination result by the pattern authenticity determination step is true By executing the data update program of the volatile memory, it is possible to prevent unintended data erasure and data tampering with any model and any manufacturer's nonvolatile memory.

  According to the nonvolatile memory data update method, the control device, and the nonvolatile memory data update program according to the present invention, unintentional data erasure and data tampering can be performed on the nonvolatile memory of any model and any manufacturer. It is possible to realize a protection function at the application level, which has versatility that can be prevented and practicality that can be realized inexpensively and easily.

  The best mode for carrying out the present invention will be described below with reference to the drawings. In the following, a flash ROM is considered as an example of a nonvolatile memory, and a case where this flash ROM is mounted on a card reader will be described.

[Electrical configuration]
FIG. 1 is a block diagram showing an electrical configuration of a system that executes a data update method for a nonvolatile memory according to an embodiment of the present invention.

  Referring to FIG. 1, a system for executing a method for updating data in a nonvolatile memory according to an embodiment of the present invention includes a card reader 10 having flash ROM 1, CPU 2, RAM 3, ROM 4, and I / F port 5, and a host such as ATM. And a computer 11.

  The host computer 11 is electrically connected to the CPU 2 mounted on the card reader 10 via the I / F port 5, and the flash ROM 1, ROM 4, and RAM 3 are also electrically connected to the CPU 2. . The CPU 2 can execute processing (refer to FIG. 5) for each process such as saving to the RAM 3, data updating, sector erasing, and sector writing to the flash ROM 1 in the same manner as the conventional nonvolatile memory data updating method.

  The flash ROM 1 is composed of a plurality of memory areas (sectors). In the process of the sector erase (step S103 in FIG. 5) described above, all data in the sector must be erased once. Yes. The flash ROM 1 also stores a supervisor program (BOOT program) that rewrites an execution program for controlling the operation and functions of the card reader 10 and determines whether or not the execution program is normal. There are a plurality of sectors to be stored, such as a sector for storing backup data and a sector for storing an execution program that is actually executed by the card reader 10.

  In particular, the BOOT program does not require rewrite processing. If an unintentional erroneous erasure or erroneous writing is performed, the operation of the card reader 10 may become unstable. For this reason, the card reader 10 according to the present embodiment prevents erroneous erasure or erroneous writing of the BOOT program. Hereinafter, a sector erasing process for erasing a sector to which data that needs to be updated belongs will be described in detail.

[Sector erase process]
FIG. 2 is a flowchart showing the flow of the sector erasing process in the method for updating data in the nonvolatile memory according to the embodiment of the present invention. As shown in FIG. 2A, the sector erase process is divided into a plurality of sector erase procedures (sector erase procedure 1, sector erase procedure 2,...).

  In FIG. 2A, first, sector erase procedure 1 is executed (step S1). More specifically, the CPU 2 of the card reader 10 reads the function ROMClear () stored in the ROM 4 and executes the sector erase procedure 1 corresponding to the first procedure in the processing of this function.

  Next, when the sector erasing procedure 1 is completed, the CPU 2 executes a pattern authenticity determination process (step S2). More specifically, the CPU 2 of the card reader 10 reads the function Actcheck () stored in the ROM 4, accesses the RAM 3, and stores a predetermined pattern (for example, character string, number, etc.) stored based on a command from the host computer 11. It is determined whether or not there is an error in any of a sequence, a code sequence having no meaning, etc. (which may be any predefined sequence). If there is no error, true is returned as the return value of the function Actcheck (), and false is returned as the return value of the function Actcheck () when there is an error at one location. Details of the pattern authenticity determination step will be described later with reference to FIGS.

  Next, the CPU 2 determines whether or not the determination result of the pattern authenticity determination step in step S2 is true (step S3). More specifically, as described above, the CPU 2 determines whether true is returned as a return value of the function Actcheck () or whether false is returned.

  If true is returned as the return value of the function Actcheck (), the process proceeds to step S4. On the other hand, if false is returned as the return value of the function Actcheck (), the process is assumed to be abnormal. Interrupt.

  In step S4, sector erase procedure 2 is executed. More specifically, the CPU 2 executes the sector erase procedure 2 corresponding to the second procedure in the process of the function ROMClear () read in step S1.

  Next, when the sector erasing procedure 2 is completed, the CPU 2 executes the pattern authenticity determination process again (step S5). Then, as described above, it is determined whether the return value of the function Actcheck () is true or false (step S 6). If it is true, the process proceeds to the next step. Stop processing.

  As described above, a series of processes of sector erasure procedure → pattern authenticity determination step → authentication determination is repeated a plurality of times, and finally, the CPU 2 determines whether or not the erasure is completed (step S7). If the CPU 2 determines that the erasure has not yet been completed, it repeats the process of step S7, while if it determines that the erasure has been completed, it ends the sector erasure process.

  As described above, in the data update method of the flash ROM 1 according to the present embodiment, since the pattern authenticity determination process is appropriately embedded in the plurality of sector erasing procedures, unintended data erasure and data tampering have been attempted. Even if the program counter accidentally jumps onto the code of the function ROMClear () due to program runaway or the like, data erasure or data tampering is not actually performed. Therefore, the reliability at the time of updating the data in the flash ROM 1 can be improved. As described above, erroneous erasure or erroneous writing of the BOOT program can be prevented.

  In FIG. 2A, the pattern authenticity determination step is executed immediately after each sector erasing procedure, and the protection function is superimposed, so that unintended data erasure can be prevented more reliably. It is. In FIG. 2A, the sector erasing process is considered, but the same can be said for the sector writing process. In other words, the sector writing process is divided into a plurality of sector writing procedures, and the function ROMWrite () stored in the ROM 4 is read to execute the pattern authenticity determining process immediately after each sector writing procedure. In this way, unintended data writing can be prevented more reliably.

  On the other hand, in FIG. 2B, in the sector erasing step, first, a plurality of sector erasing procedures (step S11, step S12, step S13,...) Are executed, and then the pattern authenticity determining step is executed. (Step S14). Then, after the sector erase procedure F for actually executing the erase is executed, it is determined whether or not the erase is completed (step S16). As described above, the pattern authenticity determination step can be executed only once before the last sector erase procedure F. As a result, a protection function at the application level can be realized with a minimum processing load.

  Next, the pattern authenticity determination process described with reference to FIG. 2 and the pattern storage process that is a prerequisite process of the pattern authenticity determination process will be described in detail below.

  FIG. 3 is a flowchart showing the flow of the pattern storage process which is a precondition for the pattern authenticity determination process. In particular, when a plurality of predetermined patterns are stored in the RAM 3 in order, it is a flowchart characterized in that it is determined step by step whether or not the predetermined pattern stored immediately before is normally stored.

  In FIG. 3, first, when receiving a command from the host computer, the CPU 2 reads the function SetArea_0 () independent from the ROM 4 based on this command, and stores a predetermined pattern in the RAM 3. When the CPU 2 receives the next command from the host computer, the CPU 2 reads the function SetArea_1 () independent from the ROM 4 based on this command, and stores a predetermined pattern in the RAM 3.

  However, when the second and subsequent patterns are stored in the RAM 3, the CPU 2 determines whether the pattern stored immediately before is normal, that is, whether the predetermined pattern stored immediately before is correct. Determination is made (step S21).

  If the CPU 2 determines that it is normal, the CPU 2 stores the predetermined pattern in the RAM 3 (step S22), and ends this subroutine. On the other hand, if it is determined that it is not normal, the predetermined pattern is not stored in the RAM 3, and all the predetermined patterns on the RAM 3 recorded until immediately before are cleared to zero (step S23), and this subroutine is terminated. To do. In “zero clear”, zero may be written, but another predetermined value (for example, “1”) may be written.

  As described above, according to the pattern storing step shown in FIG. 3, even if the predetermined pattern is stored in the RAM 3 based on the command from the host computer 11, it is checked whether an incorrect pattern is stored. Further, the reliability of the data update method of the flash ROM 1 can be further improved. Note that the return value of the function Actcheck () will not be true unless the function SetArea_0 () to the function SetArea_n () are executed in a predetermined order.

  The CPU 2 reads the function SetArea_0 () independent from the ROM 4, and simultaneously activates the timer function (for example, sets a timer value in the variable AreaTimer) and reads the function SetArea_n () for storing the last predetermined pattern. If it is determined that a predetermined time has elapsed (for example, when it is determined that the variable AreaTimer has become zero), all areas may be cleared to zero. As a result, since a series of processes must be completed within the time set in the variable AreaTimer, the completion of the process within the time is added to the condition, and the protection function can be further tightened.

  FIG. 4 is a flowchart showing the flow of the pattern authenticity determination process executed in the sector erasing process shown in FIG. It is assumed that the pattern storage process shown in FIG. 3 has been completed as a prerequisite process for performing this pattern authenticity determination process.

  In FIG. 4, first, the CPU 2 reads the function Actcheck () stored in the ROM 4, accesses the area 0 of the RAM 3, and determines whether there is no error in the predetermined pattern (step S 31). If it is determined that there is no error and it is normal, then the area 1 of the RAM 3 is accessed to determine whether or not there is an error in the predetermined pattern (step S32). Similarly, access is made to area n of the RAM 3 to determine whether or not there is an error in the predetermined pattern (step S34). When it is determined that there is no error in the predetermined pattern for all areas from area 0 to area n, true is returned as the return value of the function Actcheck (). On the other hand, if it is determined that there is an error in any one of the areas from area 0 to area n, the area 0 to area n is cleared to zero (step S35) and the function Actcheck is performed. Return false as the return value of ().

  As described above, the flash ROM 1 data update method including the pattern storage process (see FIG. 3), the pattern authenticity determination process (see FIG. 4), and the sector erase process (see FIG. 2) can be performed by any model. Any manufacturer's non-volatile memory has both versatility to prevent unintended data erasure and data tampering, and practicality that can be realized inexpensively and easily.

  It should be noted that the above-described supervisor program does not normally operate itself but must manage a proper recovery operation if the main program is erroneously erased or erroneously written for some reason. Therefore, it is assumed that no erasure or writing is performed by an erroneous operation. However, in the worst case, if a bug or specification change that requires rewriting these programs occurs, it will not be possible to collect and update without leaving some means.

  Similarly, for example, a serial number for identifying an individual or fulfillment data at the time of manufacture is generally incapable of being overwritten or erased once written. However, if rewriting or initialization cannot be performed at all, maintenance cannot be performed.

  In this way, in order to prevent normal processing such as initialization, deletion, and overwriting, it is necessary to have a mechanism that can suppress execution with simple commands and operations, and in some cases can cancel execution suppression. It is. Therefore, if the data update method of the nonvolatile memory according to the present embodiment is used, execution can be suppressed by a simple command or operation, while execution suppression is canceled by a control program composed of various functions at the application level. Therefore, even if the non-volatile memory is replaced with a substitute or substitute model of another manufacturer for reasons such as a discon or missing item, the benefit of the protect function can be continuously received without changing the program. be able to.

  The nonvolatile memory data update method, control device, and data update program according to the present invention are useful for preventing unintentional data erasure and data tampering with any model and any manufacturer's nonvolatile memory. It is.

It is a block diagram which shows the electric constitution of the system which performs the data update method of the non-volatile memory which concerns on embodiment of this invention. 5 is a flowchart showing a flow of a sector erasing step in a method for updating data in a nonvolatile memory according to an embodiment of the present invention. It is a flowchart which shows the flow of the pattern memory | storage process used as the premise process of a pattern authenticity determination process. 3 is a flowchart showing a flow of a pattern authenticity determination process executed in the sector erasure process shown in FIG. It is a flowchart which shows the flow of the data update method of a non-volatile memory.

Explanation of symbols

1 Flash ROM
2 CPU
3 RAM
4 ROM
5 I / F port 10 Card reader 11 Host computer

Claims (6)

Non-volatile memory data updating method including a sector erasing process in which a CPU mounted in a lower-level device uses a storage unit that stores a predetermined pattern based on a command from the higher-level device to erase a sector to which data that needs to be updated belongs Because
The sector erasing step includes
A pattern authenticity determining step in which the CPU determines whether the predetermined pattern is true or not before at least the last sector erasing procedure among the plurality of sector erasing procedures .
A method of updating data in a nonvolatile memory, wherein the sector is erased when a determination result by the pattern authenticity determination step is true. A plurality of the predetermined patterns are stored in each storage area of the storage means,
The pattern authenticity determination step determines the authenticity of the predetermined pattern a plurality of times,
The sector erase process, the time pattern authenticity determination process by the determination result are all true, non-volatile data updating method of a memory according to claim 1, characterized by erasing the sector. When a plurality of the predetermined patterns are stored in each storage area of the storage means,
3. The storage device according to claim 2 , wherein when a predetermined pattern stored immediately before is not normally stored, a plurality of predetermined abnormal patterns are stored in each storage area of the storage means instead of the predetermined pattern. Data update method for non-volatile memory. When a plurality of the predetermined patterns are stored in each storage area of the storage means,
Wherein when a predetermined pattern has not been stored all within a predetermined time, according to claim 2 or 3 predetermined abnormal pattern in place of the predetermined pattern is characterized in that it is more stored in each storage area of said storage means The data update method of the non-volatile memory as described. Controller of the non-volatile memory having a control means for executing data updating method of the nonvolatile memory according to any of claims 1 4. Data update in a non-volatile memory in which a CPU mounted in a lower-level device executes a sector erasure process for erasing a sector to which data that needs to be updated belongs, using a storage unit that stores a predetermined pattern based on a command from the higher-level device A program,
The sector erasing step includes
A pattern authenticity determining step in which the CPU determines whether the predetermined pattern is true or not before at least the last sector erasing procedure among the plurality of sector erasing procedures .
A data update program for a non-volatile memory, wherein the sector is erased when a determination result by the pattern authenticity determination step is true.

Images