RU2235356C2 - Device for storing different versions of data sets in separate memory areas and method for refreshing data sets in memory - Google Patents

Abstract

FIELD: memorizing equipment engineering.

SUBSTANCE: data carrier for being read by computer has data structure for providing for permanent storing of a data set and has at least the oldest version of said data set in first memory area, at least one tag for identification of said version, at least latest in time of update version of said data set in the second one, different form the first one, memory area, at least one tag for identification of said latest in time updated version. Computer device has processor and at least one said carrier being read by a computer. Also included is description of operation of computer device.

EFFECT: elementary data updating and higher safety of data stored in memory.

3 cl, 5 dwg

Description

FIELD OF THE INVENTION

The present invention relates to a storage medium comprising at least one data set in a memory area. The memory means may be implemented by volatile RAM devices or non-volatile silicon devices such as EEPROM, electrically erasable programmable read-only memory device, flash ROM or ROM. Typically, such memory stores program modules of the operating system, application programs, and application data. Where such computer systems in accordance with the invention may find particular use, some or all of the software modules of the operating system are stored in ROM.

State of the art

In some applications, usually in the processing of financial transactions, storage must be performed with very high reliability. Such secure storage applications are known as requiring “basic updates” in “permanent” storage. To perform such a secure update, it is known to use update registration from the prior art. Such an update registration indicator, which forms part of the data set, must be changed during the update session. Only when the data set together with its updated parts is stored in memory, all references to the previous version of the data set can be deleted.

DE-A-19600081 discloses a computer-readable medium capable of storing various versions of a data set. Such computer-readable media stores both the old version and the latest update version. To distinguish between different versions of one from the other, both of them are identified by a counter.

The purpose of the invention

The aim of the present invention is to provide permanent storage of application data by creating an improved mechanism for the elementary updating of data stored in non-volatile memory devices, especially in silicon storage devices such as EEPROM or flash ROM.

SUMMARY OF THE INVENTION

The invention relates to a computer-readable medium as claimed in claim 1.

The use of such unique tags associated with different areas of memory allows you to uniquely identify which of the versions are older. In addition, the use of such tags allows you to identify which versions belong to the same source dataset. Thus, different versions of different data sets may simultaneously be present in memory. Moreover, during the update of the latest update version, older versions, as well as the latest update version, are not deleted from memory. Only after the update operation of the latest update has been completed is the oldest version of the data set can be deleted from memory.

If the update is interrupted during the update operation, the latest version of the update is still present in the memory, thus guaranteeing the presence of at least one reliable version of the data set. Thus, the “elementary update" is guaranteed. Such an elementary update guarantees either a complete replacement of the data, or unmodified, previously stored data, even if the update operation is interrupted.

Each version of the data set is stored on one or more pages of memory, and each page of memory includes one tag, each tag containing links to the data set, version number, and page number.

A page is defined as a memory area with sequential memory cells that deal with storage units appropriate for the storage technology in question. Each page can correspond to one numerical bus, thereby making it easier to read and write storage units into memory. Version numbers are assigned to different dataset generations. Thus, different version numbers refer to different generations. Different page numbers refer to different pages of the same dataset generation.

The invention also relates to a computer device including a processor and at least one computer-readable medium, as defined above.

The processor is preferably designed to write tags with redundancy in relation to the contents and, after reading the tags from the memory means, analyzing based on redundancy whether there have been write errors or not. Such redundancy can be used as an indication of whether the tags in question and the datasets referenced by the tags have reliable values.

The latest update version preferably contains a plurality of pages, each page having a unique tag, and the processor is designed to update the last updated version of said data set and write a predetermined tag to a predetermined one of the many pages in said memory medium as the last stage of the mentioned update. The predefined tag that is written last can be read by the processor. If the processor determines the presence of this predefined tag in the memory means, then the processor can conclude that the update operation has been completely completed.

The use of such tags provides several new features. For example, at least one of the tags may include additional information regarding the indication of ownership and rights of use, the processor being designed to recognize ownership and rights of use from this additional data.

Use rights may vary for different parts of the data set, and the processor may be designed to recognize these different use rights for these different parts.

The processor is preferably designed to analyze tag values and can only access versions of the data set by reference through tag values. Access to different versions of the data set is thus not controlled by a regular software counter, but by tag values. In other words, memory has become associative memory.

In the latter embodiment, the processor preferably comprises a central processing unit and a separate memory management unit, in which tag values are known only to the memory management unit. Further, the physical address space of the memory means is not included in the address space of the central processing unit, especially not included in the address space where the application program or program instructions of the operating system are stored. In this way, additional protection against “sensing” can be obtained. In order to realize this potential protection, the memory control unit may provide the central processing unit with additional interface functionality with an address register of tag size.

In order to increase the security of the stored data, the memory management unit can encode the tags with a cryptographic key before writing them to the memory, and the cryptographic key is known only to the memory management unit. Such a cryptographic key may refer to a cryptographic one-way function.

The present invention also relates to a method as claimed in paragraph 13.

(b) storing the latest update version of said data set in a second separate memory area in which said second memory area includes a second tag for uniquely identifying said latest update version.

Brief Description of the Drawings

The present invention is described in detail below with reference to several drawings, which are intended only to illustrate the present invention, and not to limit its scope.

Figure 1 presents an example of an embodiment in accordance with the present invention.

Figure 2 shows a possible memory allocation in accordance with the present invention.

Figure 3 presents the contents of the memory pages in a possible embodiment of the device in accordance with figure 2.

Figure 4 shows the method in accordance with the present invention.

Figure 5 presents a possible device of the memory control unit in accordance with the present invention.

Description of the preferred embodiment

Figure 1 presents one possible device in accordance with the present invention. The central processing unit 2 is connected to the input / output means 12 and to the memory, which may contain ROM 6, RAM 8 and non-volatile memory 10. The memory management unit 4 can be performed separately or inside the central processing unit 2. The control unit 4 is designed to perform functions memory, which are related to non-volatile memory 10, and also preferably to other sections of memory - ROM 6 and RAM 8. The embodiment shown in figure 1, applies to all types of storage management systems. The invention, however, is particularly useful with respect to data storage in non-volatile silicon devices, and not on hard disks. Important applications relate to embedded computer systems and single-chip computers, such as smart cards (smart cards).

Figure 2 shows one possible memory storage device in accordance with the present invention. Non-volatile data memory 10 can be divided into storage units. Here, these in-memory storage units are called “pages”. It is convenient if these pages are the same size, for example, equal to the dimensions of the “numerical bus" in silicon devices used to implement memory. Pages, however, may be of different sizes. The contents of the memory are controlled by the memory management unit 4 per page: the allocation, updating and freeing of memory for storing application program data includes the management of one or more pages.

The memory contains various generations (or versions) of a set of data elements of application programs. Each generation can be stored on one or several pages. Figure 2 shows the case where the memory includes three different generations k, k + 1, k + 2 of one set of application data elements. The example shows that generation k occupies three pages 1, 2 and 3, generation k + 1 - two pages i, i + 1, and generation k + 2 - two pages n, n + 1. Generation k is the oldest version of the set of application data elements in memory, while generation k + 2 is the latest update version of the set of application data elements. Each of the generations k, k + 1, k + 2 can, for example, refer to different versions of a program object.

Generations k, k + 1 and k + 2, as indicated, form a “data fragment”, and this term is used here as a reference to a single set of data elements of an applied problem. The pages required for storage are distributed over any memory cells that are not occupied by the page, which is determined by the memory management unit 4. Various generations k, k + 1, k + 2 of the data fragment shown in FIG. 2 may or may not be stored in memory in successive memory cells. The memory management unit 4 is a unit for deciding where to store the different generations. Even pages in one generation do not need to be stored in consecutive pages. To illustrate this page, n and n + 1 are shown spaced apart from each other (shown by dots between them).

In practice, memory includes several “data fragments”, i.e. multiple sets of generations of different data sets.

In the memory organized and managed in accordance with the present invention, the elementary nature of the update is provided by the basic control principle performed by the memory control unit 4. If the data is stored in memory, then the data associated with the version of the set of application data elements is never modified in the same memory area. In other words, a page once created is never modified. When the last updated set of application data elements requires a change in accordance with the application program running on the central processing unit 2, a new memory area, for example a new set of pages, is allocated by the memory management unit 4. Any changed values are entered into this new memory area by the memory management unit 4 along with the values of the data elements of the set of application data elements that have not been changed. Thus, the memory 10 at any time contains at least one consistent, reliable version of the data fragment.

Such an update operation may, for example, relate to a smart card. Although updating the data in the smart card takes only a very short period of time (for example, about 3 ms), there is little chance that the smart card will be removed from the communication terminal before the financial transaction with the terminal is completed. Thus, the update can be interrupted before it is completed. If this happens, at least the latest updated version will still be present in the memory of the smart card.

In one embodiment, after the update of the data set is completed, the memory management unit 4 frees a memory area storing the oldest version of the data set. The memory management unit 4 can, for example, control the presence of no more than 10 versions of one set of data elements of the application. In practical implementation, an application program running on the central processing unit 2 interacts with the memory management unit 4 to control the process of updating its data, for example, indicating the completion of the update. The application program informs the memory management unit 4 of the completion of the update, after which the memory management unit 4 completes the write operations to the memory 10. Such signal transmission during the update process is common in financial processing systems.

When several versions of the set of application data items are present in the memory, the history of the data modification can be analyzed by the memory management unit 4. The memory management unit 4 accomplishes this by providing means for checking, but not modifying, with an application running on the central processing unit 2, data values in previous versions.

Figure 3 shows a possible structure of a memory page in accordance with the present invention. It is assumed that the memory is divided into pages. Figure 3 shows two pages i, i + 1. Each page i, i + 1 contains the data of the application program and the tag i, i + 1. The tag value preferably consists of three parts: the “identifier of the chid fragment”, the generation number # # and the page number #. The fragment identifier serves as a unique reference to the program unit of the stored data. The counter # generations determines the version number of the stored data. At least two generations are indicated by counters of gen # generations. The pg # page counter indicates the page number considered in generating the set of program data to which the page belongs. The pg # page counter really allows data set generation data to be stored as multiple pages.

In one particular implementation of the invention, the tag value is stored in memory using special encoding, for example using redundancy, for example, with a check number of bits set to one. This special encoding is used by the memory management unit 4 to detect correct / incorrect data write operations. If only the checked number of bits is determined to be equal to one (or a high level), then the memory control unit 4 decides that the tag value is reliable. If this checked number of bits is not set to one, then the memory management unit 4 decides that the tag value is invalid. This may be caused, for example, by interruption of the power supplied to the storage device, for example, when a smart card user removes his smart card from the terminal before the financial transaction is completed.

In such an embodiment, before deleting the oldest generation of the data set, the memory control unit 4 determines the reliability of the latest generation update. A specific tag encoding method may be determined from the physical characteristics of the silicon storage device used. It must be chosen so as to have a very high probability of invalidation if it is not possible for this storage device to write the page completely. Depending on the design of the memory chip (i.e., the transistor technology used), before writing new data to a page, some memory devices first replace the values of all memory cells of a given page with either zeros or ones. Therefore, as indicated above, it is sometimes better to check that the checked number of bits in a tag is one, while in other cases it may be better to check for a checked number of bits equal to zero. Then, if during the control the tag is determined to be correct, then it is a matter of well-known probability whether the contents of the rest of the page related to the tag are recorded correctly or not.

Figure 4 summarizes the sequence of operations performed by the unit 4 memory management in one embodiment of the invention when updating the version of the stored application data prescribed by the application program running on the Central processing unit 2:

a) the distribution of a new set of pages in memory 10, step 40;

b) determining the tag value of each new page of the new page set, step 42;

c) writing the page data of the application program in its modified form and the corresponding tags into memory 10, step 44;

d) checking for each recorded page that the result is correct, step 46;

this monitoring step may be performed by monitoring the tag value as described above;

e) releasing pages that contain the oldest data set generation, step 48.

The tag value for each new page is determined by the assigned chid fragment identifier, the value of the #gene # generation number of the latest version update time increased by 1, and the pg # page number.

The pages are preferably written to the memory 10 per page, as indicated in step c) above. Preferably, one predefined page from a set of pages for one data set is recorded last, while all other pages can be written in any order. Conveniently, the predefined page is the first page of a new set of pages. In practice, any pages can be written in parts. For example, the value of the page tag can be written separately from the application data on the page. Preferably, however, the tag of the predetermined page, which is the last page for recording, is recorded in the last step of the update operation. This is a clear indication that the update operation is complete. Until this tag of the predetermined page is stored in memory, application data recorded in any of the new pages can also be modified.

However, it should be noted that partial recordings and modifications to the page data can reduce the benefit gained from the invention, i.e. total recording time may increase. Writing to non-volatile memory 10, as an EPROM, takes a relatively long time - currently about 3 ms. Therefore, it is best to write once to memory 10, i.e. when the entire modified dataset is ready to be saved, rather than writing the modified parts of the dataset in successive periods of time. However, if time permits, as often happens, in this technical field the modified parts of the data set are usually written to non-volatile memory. This results, however, in an increased number of write operations, which leads to excessive wear of the non-volatile memory 10.

Therefore, in accordance with an embodiment of the invention, it is preferable that all steps necessary to completely change the data set are performed on a working copy of the data set in RAM 8 before writing the modified data set to non-volatile memory 10.

Recording the tag value of a predefined page as the last operation in an update session is a useful measure when implementing the elementary nature of a multi-page update. The presence or absence of a valid tag in a predefined page then serves as the “commit changes” flag: a valid tag in a predefined page indicates both the veracity of the recorded page and the final completion of the entire update process.

Storing the data of the application program in memory can be made even more reliable if the data stored in the memory can only be physically addressed by the application using the chid identifier of the fragment. Memory 10 then becomes “associative memory”.

Although the memory control unit 4 and the central processing unit 2 can be in the same physical processor unit, it is particularly advantageous for this last feature that the central processing unit 2 and the memory management unit 4 are two physically separate units for communicating with each other. It must be understood that the term “physically separate” can still refer to blocks produced on a single chip. Then, the space of physical addresses of the memory 10 is not included in the address space of the central processor unit 2, in particular, it is not included in the address space where the application program or program instructions of the operating system are stored. If then the memory management unit 4 is also protected against unauthorized interference (as in a smart card), then additional protection against “sensing” is achieved.

To realize this potential additional protection, for example, for smart cards, the memory management unit 4 may provide additional interface functionality, for example, including an address register 54 of tag size and a register 52 of data size of page data (see FIG. 5). This interface 52, 54 is then complemented by a logic unit 50 to perform logical functions for viewing and matching tags stored in the memory 10. In other words, the logic unit 50 can read the tags from memory 10 and address the memory 10 by analyzing the value of the tags.

The interface 52, 54 and its associated logic unit 50 may be implemented in hardware.

In addition, specific hardware circuits 56, 58 are present respectively as interfaces between the memory 6, 8, 10 and the logic unit 50 and between the central processing unit 2 and the logic unit 50. The logic unit 50 may include a dedicated address counter combined with a comparison logic tags. Various hardware circuits may comprise associative memory logic implemented on at least a memory page for storing bits reserved for hosting a tag value.

Additional security benefits can be obtained with memory managed in accordance with the invention when, in addition to special encoding for detection, the tag value is further encoded using cryptographic techniques. Such cryptographic tag coding is intended to hide application data related to structural information, such as the identifier of the chid fragment, the generation number # #, the page number # contained in the tag values. Cryptographic coding can be performed by any coding methods known to those skilled in the art. One useful way is to use secret cryptographic one-way functions in which the steps of the one-way function are associated with a secret key known only to the memory management unit 4. Thus, the memory management unit 4 can recognize the previous generation by applying a one-way function one or more times to the encoded tag value of this previous generation, and then comparing the resulting tag value with the tag value of the latest generation update time. This prevents the recovery of application data from a maliciously forced “dump” of the contents of the storage device.

The tagged memory structure, as described above, provides several useful features. For example, the tag may include additional data to indicate ownership of related application data. In addition, such additional data in the tag value may indicate usage rights or sets of usage rights for various users of application data. Such various rights of use may, for example, be associated with different conditions of access to different parts of the data of the (application) program in the memory 10. One part of the data of the (application) program can, for example, be determined only for reading, while the other part of the data of the application can be defined with read / write access.

The invention effectively provides the registration of financial transactions stored in memory, since the memory includes a history of updates of specific elements of application data in the form of successive generations.

As described above, in addition, the number of write operations to the storage devices controlled in accordance with the present invention can be reduced by using the described memory update / financial transaction registration mechanism. In addition, the reduced number of write operations provided by the invention can lead to a decrease in the cost of the silicon storage device as a result of extending its service life. The security of data stored especially in non-volatile memory in single-chip computers protected against unauthorized interference, such as smart cards, is enhanced. Improving security can be entirely achieved through programmatic measures. Hardware measures, such as a memory management unit 4 separate from the central processing unit 2, can further enhance security, but they are not strictly necessary.

Claims (16)

1. A computer-readable medium storing a data structure for permanently storing a data set, said data structure including (a) at least the oldest version of said data set in a first memory area, said computer-readable medium including at least one a tag for identifying the oldest version mentioned, and (b) at least the most recent version of the data set in the second, distinct, memory area, whereby the read the computer-readable medium includes at least one tag for identifying said last-time version update, wherein said first memory area contains a first set of one or more pages and said second memory area contains a second set of one or more pages, wherein the page contains one or more consecutive memory cells, which are operated as one unit during such operations with memory as assigning, updating and freeing memory of application data, characterized in that of each page also contains its own tag that specifies the number (gen #) version of said set of data and the number (pg #) pages mentioned page. 2. The computer-readable medium of claim 1, wherein each said tag contains a link (chid) to said data set. 3. The computer-readable medium of claim 1 or 2, wherein each page corresponds to one numeric bus. 4. A computer device including a processor (2; 2,4) and at least one computer-readable medium according to any preceding paragraph, said processor (2; 2,4) being used to process said data structure. 5. The computer device according to claim 4, in which the processor (2; 2,4) is designed to write tags with redundancy in relation to their contents and after reading the tags from the memory means, analyzing from the said redundancy, whether or not write errors have occurred. 6. The computer device according to claim 4 or 5, in which the latest update version contains many pages, each page has a unique tag, and the processor (2; 2,4) is designed to update the last updated version of the mentioned data set and recording a predetermined tag of a predetermined one of said plurality of pages into said memory means as a last step of said updating. 7. A computer device according to any one of claims 4 to 6, in which at least one of the said tags contains additional data to indicate ownership and rights of use and the processor (2; 2,4) is designed to recognize the ownership and rights of use of these additional data. 8. The computer device according to claim 7, wherein said usage rights are different for different parts of the data set and the processor (2; 2,4) is designed to recognize different usage rights for these different parts. 9. A computer device according to any one of claims 4 to 8, in which the processor (2; 2,4) is designed to analyze tag values and has the ability to access said versions of said data set only by reference through said tag values. 10. The computer device according to claim 9, wherein said processor comprises a central processing unit (2) and a separate memory management unit (4) and tag values are known only to the memory management unit (4). 11. The computer device of claim 10, wherein said memory management unit (4) encodes the tags with a cryptographic key before being written to a computer readable medium, said cryptographic key being known only to the memory management unit (4). 12. The computer device according to claim 11, wherein said cryptographic key relates to a cryptographic one-way function. 13. A method for permanently storing a data set on a computer-readable medium, comprising the steps of (a) storing the oldest version of said data set in a first memory area, wherein said computer-readable medium includes at least one tag for identifying said oldest version , and (b) storing the latest update version of said data set in a second different memory area, said computer-readable medium including at least one and a tag for identifying the last updated version of the update, wherein the first memory area contains a first set of one or more pages and said second memory area contains a second set of one or more pages, the page containing one or more consecutive memory cells that are operated on as one unit during such operations with memory as assigning, updating and releasing the memory of application data, characterized in that the said method further comprises the step of providing each pages with their own tag indicating the version number (gen #) of the mentioned data set and the page number (pg #) of the mentioned page. 14. The method according to item 13, comprising the additional step of monitoring said storage in step (b) by a predetermined operation performed on said at least one tag identifying said latest version of update time. 15. The method according to item 13, in which the last updated version of the version contains many pages, each page having a unique tag, and a predefined tag of a predefined one of the said many pages is stored as the last step in step (b), so that identify the completion of said storage in step (b). 16. The method according to item 13, further comprising the following step after step (b): (c) freeing up a memory area storing therein the oldest version of said data set, if at least two versions of said data set remain in said tool (10) ) memory.

Images