WO1999053450A1

WO1999053450A1 - Method for writing and reading the contents of a microcircuit card non volatile memory

Info

Publication number: WO1999053450A1
Application number: PCT/FR1999/000836
Authority: WO
Inventors: François Grieu; Stéphane DIDIER
Original assignee: Innovatron Electronique, Societe Anonyme
Priority date: 1998-04-09
Filing date: 1999-04-09
Publication date: 1999-10-21
Also published as: AU3152299A; FR2777372A1; FR2777372B1

Abstract

The non volatile memory is organised into sectors each comprising: a data field, preserving an informative content; an identifying field, forming an access key to the sector; and a relevance field, forming a subfield of the identifying field to discriminate among several sectors of a common user identification the one whereof the data field is to be considered. Writing data in a sector consists in: a) applying in input the data to be written and the corresponding sector user identification; b) scanning the memory to search for possible sectors whereof the user identification is the same as the one applied in input; c) scanning the memory to search for an available sector; and d) writing in said available sector: the data applied in input; the user identification applied in input; and a relevance value higher than that possibly found in step b). Advantageously, if the search in step b) is fruitless, prior to step d) an indicator is posted, and is erased subsequently to step d), said indicator signalling that possibly step d) is incomplete.

Description

1

Method for writing and reading the content of the non-volatile memory of a microcircuit card

The invention relates to microcircuit cards, and more particularly to microprocessor cards, which themselves make various modifications to their non-volatile memory.

When such modifications are made, it is of course necessary to ensure that they have been correctly carried out before being able to use the newly written information. In the opposite case, the newly written information must be ignored or deleted and the information to be considered must be that which was written in the card with the execution of the incorrect operation.

The usual cause of such an imperfect operation is the unexpected rupture of the supply due to a "tearing" of the card, that is to say a withdrawal of the latter before the end of the treatment, leading to a premature interruption coupling with the terminal. This risk is particularly high with cards of the "contactless" type, where the limits of the volume in which the card can function correctly around the terminal are not perceptible. In this case, there is a non-negligible risk of an unexpected break in communication between the card and the terminal, due to the card leaving the operating range of the terminal before the end of processing, or due to a temporary disturbance. , for example the passage of a metallic mass nearby.

An additional difficulty arises in the case of non-volatile memories of type E ² PROM with which, if a writing operation is interrupted before its normal end, it may happen that the data is nevertheless written, and can therefore be read correctly shortly after writing. However, if we repeat this reading later, it is not certain that we can do it correctly, because the retention of information in the memory cell will have been insufficient due to writing. interrupted before term.

To ensure the integrity of the data, it is therefore desirable that, by their internal memory management, the cards protect themselves against such risks, by guaranteeing that the data are either in the modified state, or in the state before request for modification, but never 2

but in an indeterminate intermediate state resulting from a "tearing".

A first solution consists in reserving a fixed area of the non-volatile memory for the temporary writing of the data to be modified. In addition to the data, this zone includes a location field (indication of the address of this data in the memory) and a control field (for example a parity type control or the like) which ensures the integrity of the data field and of the location field.

When reading, the map ignores this temporary area and the data is read in its actual location.

During a modification, the card first writes the data to be modified in the temporary zone (supposed to be erased), erases the real location of the data, writes the data from the contents of the temporary zone and ends the operation. by erasing the temporary area. Before the first access to the data since the last interruption

(normal or abnormal) operation of the card, for example when resetting ("reset"), the card controls the temporary area and:

- if it is deleted, the card does nothing;

- if it is not erased but the data and their location are intact, the card writes the data from the content of the temporary area and ends the operation by erasing the temporary area;

- if the temporary area is not deleted and the data and / or their location are not intact, the card deletes the temporary area. This first solution, the most common, has the advantage of involving only a very small additional cost in memory space (only for the temporary area).

On the other hand, it has two serious drawbacks, namely (i) rapidly using non-volatile memory because the temporary area is used for each operation, which limits the life of the card (with current technologies a memory cell E PROM supports at most 10 to 10 writes) and (ii) take a long time, which is a major drawback in contactless applications.

A second solution consists in splitting the memory into two "flip-flop" zones capable of containing the data to be protected. Each 3

zone includes in addition to the data a control field which indicates which zone contains the actual data ("relevant" zone) and which ensures the integrity of the data and its relevance.

When reading, the map determines the relevant area and reads it.

During a modification, the map determines the relevant zone and writes new data and the new control field to the other zone (supposed to be erased), which indicates that it is now this other zone which becomes the zone. relevant, then erases the initially relevant area, which has become obsolete.

When accessing an area, the card checks its integrity and erases it if it is not intact.

This second solution does not slow down processing (a single write operation on each modification), and doubles the wear limit of the non-volatile memory.

On the other hand, it does more than double the memory space necessary for data storage, which significantly increases the cost of the card.

One of the aims of the invention is to propose a method which overcomes these various drawbacks and perfectly guarantees the integrity of the data without significantly encumbering the memory space, the processing time or the lifetime of the non-volatile memory.

For the implementation of the method of the invention, the memory being organized into sectors each comprising a data field, preserving an informative content, an identifier field, forming an access key to the sector, and a field of relevance, forming a sub-field of the identifier field to discriminate among several sectors of the same identifier that whose data field is to be taken into account. Writing data in a sector consists of: a) applying as input the data to be written and the identifier of the corresponding sector; b) scan the memory for possible sectors whose identifier is the same as that applied as input; c) scan the memory for an available sector; and d) write in this available sector: the data applied as input; the identifier applied as input; and a relevance value greater than that possibly found 4

in step b).

In an advantageous form of implementation, if the search for step b) is unsuccessful, provision is made before step d) for the recording of a witness, and its erasure after step d), this witness indicating a possible incomplete completion of step d).

Preferably, when a sector whose identifier is the same as that applied as input is found in step b), then it is deleted at a step consecutive to step d).

Each sector can also include a control field, containing information for verifying the joint integrity of the three data fields, identifier and relevance; in step b), the non-integral sectors are then ignored, which can also be deleted.

Preferably, the choice of the memory location which will be written is made so as to distribute the wear of the memory, in particular by random choice of a sector among those available.

With regard to the reading of data in a sector, this consists of: A) applying as input the identifier of the sector to be read; B) scan the memory for sectors whose identifier is the same as that applied as input; and C) output the data field of a sector chosen by comparison of the fields of relevance among the sectors found in step B).

Advantageously, when one finds in step B) a plurality of sectors whose identifier is the same as that applied at the input, these sectors are subsequently or concomitantly deleted with the exception of the one whose data is output. in step C).

In the case where each sector also includes a field of. control, when we find in step B) a plurality of sectors whose identifier is the same as that applied at input, we reiterate the writing of the sector whose data is output at step C) . It is also possible to retain in step C) only the integral sectors and to delete the non-integral sectors.

Other characteristics and advantages will emerge from the description below of an exemplary implementation of the invention. 5

Example

In this example, the data in the memory is organized into sectors, each comprising four fields: 1. data;

2. identifier (access key for selecting a sector);

3. relevance: used to determine the relevant sector if two sectors have the same identifier;

4. control: allows you to verify the integrity of the three preceding fields (for example a parity type control).

A sector will be designated by its identifier, a concept which replaces that of address. The procedure for writing a sector has as parameter an identifier and data to be associated with this identifier. The procedure for reading a sector has as parameter an identifier, and returns the data associated with this identifier during the last write operation performed with this same identifier (or an appropriate indication if this identifier has never been used). In other words, an associative type access is performed instead of an indexed access.

During the procedure for reading a sector, the card searches for the sectors whose identifier has the requested value, and which (based on the control field) are intact. If several sectors meet these two criteria, it selects one based on the field of relevance.

When writing a sector, the card writes, in an available sector, the data and identifier fields requested, the relevance field as this sector will be, for the reading procedure, the most relevant of the integral sectors having this identifier , and the control field in accordance with the three preceding fields (in other words, the writing is managed so that the subsequent reading can be correctly carried out).

Advantageously, the writing procedure continues by erasing the sector rendered irrelevant by writing the new sector, thus creating a new available sector.

An (additional) garbage collection system is advantageously provided, that is to say recovery of unnecessary sectors, 6

whether they are not honest or irrelevant.

Advantageously, a system is provided which distributes the wear resulting from writing while avoiding always using the same sectors, for example by randomly choosing a sector from the available sectors.

A generally advantageous variant of the sector search procedure consists in taking advantage of this search step to erase the sectors which are determined to be non-honest, and / or those which are not the most relevant, thus recreating sectors free (this loses time during this reading, in favor of the speed of subsequent reads and writes). Advantageously, before erasing a sector which has been determined to be integral but not relevant, the relevant sector will again be written, the writing of which may be imperfect. The useful size of the memory is equal to the number of sectors available, minus one sector which must remain erased. All sectors (including the deleted one) are dynamically distributed in the memory.

If the data must be structured in files, for example according to ISO / IEC 7816-4, the sector identifier is broken down into two sub-fields, a file identifier and a sector identifier in this file.

We will give below an implementation (not limiting) of the read / write operations using this particular structuring in sectors:

- The control field contains, binary coded, the number of bits at zero in the other three fields; it is shown that if a problem such as an interrupted writing or erasing modifies any number of bits of the sector all in the same direction, the control of the value of the control field always allows the detection of the problem.

- The relevance field is an integer from 0 to 3, coded on 2 bits.

- The reading procedure searches sequentially all the sectors until finding a first sector with the sought identifier, and integrates. If this search does not find any sector, we 7

ends the procedure with a report "sector not found". If we find such a first sector, we memorize its position, its data, and its relevance p. The research continues. If we detect a second sector with the sought identifier, and integrate it, we test if its relevance q is the rest of the integer division of p + 1 by 3; if so, write the second sector again, delete the first and return the data of the second; otherwise, the first sector is written again, the second is deleted and the data from the first is returned. If a second sector is not found and if the relevance of the first sector is p = 3, we delete this sector and give the report "sector not found"; in the other cases, the data of the first sector found is returned.

- The writing procedure starts like the reading procedure above. If we have found the sector that the reading procedure would return for the identifier provided, we memorize the position of this sector and its relevance p (which is 0, 1 or 2); if it has not been found, we select a free sector (by the procedure below) and we write in this sector the fields identifying, data, relevance p = 3 and control, and we memorize the position and the relevance of this sector. In both cases, we continue by selecting a free sector (using the procedure below). We write in this sector the fields identifier, data, relevance q (calculated like the rest of the whole division of p + 1 by 3) and control. Then we erase the memorized sector. - For the search for free sectors, the number n of free sectors found is initialized to zero. The sectors are examined sequentially. For each sector, if it is not blank and not integrated, it is deleted and it becomes blank (thus contributing to the garbage collection mentioned above); if it is integral and if its relevance is p = 3, it is deleted (idem); if it is integral and if its relevance is not p = 3, then we search in the area not yet visited for another integral sector with the same identifier, and if we find one we delete the one which is not relevant, as for reading; if at the end of this process the sector is blank, we increment the number n of free sectors found, and we draw 8 random of an integer from 0 to n-1; if this integer is 0, the position of the blank sector is memorized. When all the sectors have been traversed, all the non-virgin sectors are integral, there are no two sectors with the same identifier, we know the number n of virgin sectors, and we have memorized one of them chosen at random equally likely. If no free sector is found, the writing procedure is interrupted.

The process according to the invention which has just been described has, as can be understood, numerous advantages:

- in the event of interruption of the operation during a writing or an erasure, a subsequent reading will always reliably restore the data, ie the data before writing (in the case of an interruption early in the writing process), either the newly written data (in the event of a late interruption at the end of the writing process);

- the number of operations which modify the state of the non-volatile memory is minimized (a writing then a sector erasure by using the writing procedure, in the most frequent case where there is no processing exception), saving time;

- the sector modifications which cause non-volatile memory wear are distributed; in the worst case (where all the sectors are used except one, and where the writing is repeated with the same identifier), the card doubles the theoretical endurance compared to a known reading process; if one chooses judiciously, for example at random, the sector where one is going to write among N erased sectors, the wear is statistically reduced by a factor of the order of N + l.

- These advantages are obtained with a very low additional cost in memory space;

- we can easily implement a file structure in the map and plan a dynamic memory allocation: when creating files, it is indeed not necessary to predefine and freeze their size.

Claims

9 CLAIMS

1. A method of writing the content of the non-volatile memory of a microcircuit card, characterized in that, this memory being organized into sectors each comprising:

- a data field, retaining informative content,

- an identifier field, forming an access key to the sector, and

- a relevance field, forming a sub-field of the identifier field to discriminate among several sectors of the same identifier identifying the one whose data field is to be taken into account, writing data in a sector consists of: a) apply as input the data to be written and the identifier of the corresponding sector; b) scan the memory for possible sectors whose identifier is the same as that applied as input; c) scan the memory for an available sector; and d) write in this available sector: the data applied as input; the identifier applied as input; and a relevance value greater than that possibly found in step b).

2. The writing method of claim 1, in which, if the search for step b) is unsuccessful, provision is made before step d) for the recording of a witness and its erasure after step d), this indicator indicating a possible incomplete completion of step d).

3. The writing method of one of claims 1 or 2, wherein, when we find in step b) a sector whose identifier is the same as that applied as input, then we erases at a step subsequent to step d).

4. The writing method of claim 1 or 2, in which each sector also comprises:

- a control field, containing information verifying the joint integrity of the three data fields, identifying 10

ant and relevance, and in which, in step b), the non-integral sectors are ignored.

5. The writing method of claim 4, in which the non-integral sectors are erased.

6. The writing method of claim 1, in which the choice of the memory location which will be written is operated so as to distribute the wear of the memory, in particular by random choice of a sector among those available.

7. A method for reading the content of the non-volatile memory of a microcircuit card capable of being written by the method of one of claims 1 to 6, characterized in that the reading of data in a sector consists of:

A) apply as input the sector identifier to be read;

B) scan the memory for sectors whose identifier is the same as that applied as input; and

C) output the data field of a sector chosen by comparison of the fields of relevance among the sectors found in step B).

8. The reading method of claim 7, in which, when a step (B) is found in a plurality of sectors, the identifier of which is the same as that applied as input, these or subsequent erasures are sectors with the exception of the one whose data is output at step C).

9. The reading method of one of claims 7 and 8, in which, when we find in step B) a plurality of sectors whose identifier is the same as that applied as input, we reiterates rewriting of the sector whose data are output at step C).

10. The method of reading one of claims 7 to 9 taken in dependence on claim 4, in which it is not retained in step C) 11

than the integrated sectors.

11. The reading method of claim 10, in which the non-integral sectors are deleted.