Granted Patent B2

US 9,430,650 · App. 13/437,124 · Granted Aug 30, 2016

Abstract

Claims (71)

1. A method for managing non-volatile memory space in a secure processor comprising a secure non-volatile internal memory, the method comprising steps of:

associating an export eligibility flag with each data element in the internal memory, each eligibility flag indicating whether the associated data element is erasable from the internal memory and exportable in a data block,

each time new data are inserted into the secure non-volatile internal memory, if the new data are associated with an export eligibility flag indicating that the new data are erasable, exporting the new data in one or more data blocks to an external memory, and for each data block to be exported:

generating, by the secure processor, the data block from the new data, and a signature computed from the data inserted into the data block using a secret key generated by the secure processor,

transmitting the data block by the secure processor to store the data block in an external memory, and

storing the transmitted data block in the external memory.

2. The method according to claim 1 , comprising transmitting a data block containing a data element to load in the internal memory, to the secure processor, comparing the signature read in the data block with a signature computed from the data block, and loading the data element in the internal memory only if the signature read corresponds to the signature computed.

3. The method according to claim 2 , comprising:

requesting the secure processor to execute an application which is not stored in the internal memory but rather in a data block stored in the external memory,

selecting data elements in the internal memory,

transmitting to the secure processor a data block containing the application to execute,

loading in the internal memory by the secure processor, the application in the transmitted data block, using if necessary space of the internal memory occupied by the selected data elements, and

executing the application loaded in the internal memory.

4. The method according to claim 1 , wherein the secure processor computes a checksum from each data element to be exported in a data block, inserts each checksum in the data block, and computes a signature from data in the data block using the secret key, and prior to loading a data element from a data block in the internal memory, the secure processor checks the signature and checksum, and the data element is loaded from the data block in the internal memory only if the signature and checksum are right.

5. The method according to claim 1 , wherein prior to being inserted in a data block, a selected data element is encrypted by the secure processor using a secret key generated by the secure processor, and prior to being loaded in the internal memory, an encrypted data element read in a data block is decrypted by the secure processor using the secret key.

6. The method according to claim 1 , wherein each data block comprises:

application data comprising data of at least one data element inserted in the data block, and

administration data comprising a data block identifier, a data element descriptor for each data element in the application data, and a signature computed from the data block identifier and each data element descriptor, wherein each data element descriptor of a corresponding data element comprises a data element identifier of the corresponding data element, a data element size of the corresponding data element, a data element checksum computed from all the data of the corresponding data element, and a data element type specifying whether the corresponding data element is executable code or application data.

7. The method according to claim 6 , wherein the secure processor attributes a new data block identifier to each data block which is generated or updated and transmitted to be stored in the external memory.

8. The method according to claim 1 , comprising:

at a first activation of the secure processor, generating by the secure processor an initial configuration data block containing data elements configured as erasable from the internal memory, and transmitting by the secure processor the generated initial configuration data block to be stored in the external memory, and

restoring an initial configuration of the secure processor comprising erasing data elements configured as erasable in the internal memory, transmitting to the secure processor the initial configuration data block, and loading the data elements from the initial configuration data block in the internal memory.

9. The method according to claim 1 , wherein the secure processor keeps a table up-to-date, containing for each data element loaded in the internal memory:

an identifier of the data element,

the export eligibility flag,

an export state indicating if the data element has been erased from the internal memory and exported in a data block.

10. The method according to claim 9 , wherein the table contains authentication data for each data element in the internal memory.

11. A portable device comprising a secure processor and an external non-volatile memory, the secure processor comprising an internal non-volatile secure memory, wherein the secure processor is configured to:

generate a secret key,

associate an export eligibility flag with each data element in the internal memory, each eligibility flag indicating whether the associated data element is erasable from the internal memory and exportable in a data block,

each time new data are inserted into the non-volatile secure internal memory, if the new data are associated with an export eligibility flag indicating that the new data are erasable, export the new data in one or more data blocks to an external memory, and for each data block to be exported:

generate the data block comprising the new data, and a signature computed from the data inserted into the data block using the secret key, and

transmit the data block to store the data block in the external memory.

12. The device according to claim 11 , wherein the external memory is directly controlled by the secure processor, which is linked to the external memory by a bus.

13. The device according to claim 11 , wherein the external memory is controlled by an unsecure processor linked to the secure processor by a bus.

14. The device according to claim 11 , wherein the secure processor is configured to:

receive a data block containing a data element to load in the internal memory,

compute a signature from the received data block,

compare a signature read in the data block with the signature computed from the data block, and

load the data element in the internal memory only if the signature read corresponds to the signature computed.

15. The device according to claim 14 , wherein the secure processor is configured to:

receive a request to execute an application which is not stored in the internal memory but rather in one or more data blocks stored in the external memory,

select data elements in the internal memory,

request a data block containing the application to execute,

receive the data block containing the application to execute,

load in the internal memory, the application in the transmitted data block, using if necessary space of the internal memory occupied by the selected data elements, and

execute the application loaded in the internal memory.

16. The device according to claim 11 , wherein the secure processor is configured to:

compute a checksum from each data element to be exported in a data block,

insert each checksum in the data block, and

compute a signature from data in the data block using the secret key, and prior to loading a data element from a data block in the internal memory check the signature and checksum, and

load the data element from the data block in the internal memory only if the signature and checksum are right.

17. The device according to claim 11 , wherein the secure processor is configured to:

encrypt a selected data element using the secret key, and

insert the encrypted data element in a data block.

18. The device according to claim 11 , wherein the secure processor is configured to:

read an encrypted data element in a received data block,

decrypt the encrypted data element read in the data block, using the secret key, and

load the decrypted data element in the internal memory.

19. The device according to claim 11 , wherein each data block comprises:

application data comprising data of at least one data element inserted in the data block, and

administration data comprising a data block identifier, a data element descriptor for each data element in the application data, and a signature computed from the data block identifier and each data element descriptor, wherein each data element descriptor of a corresponding data element comprises a data element identifier of the corresponding data element, a data element size of the corresponding data element, a data element checksum computed from all the data of the corresponding data element, and a data element type specifying whether the corresponding data element is executable code or application data.

20. The device according to claim 19 , wherein the secure processor is configured to attribute a new data block identifier to each data block which is generated or updated, and transmitted to be stored in the external memory.

21. The device according to claim 20 , wherein the secure processor is configured to:

at a first activation of the secure processor, generate an initial configuration data block containing data elements configured as erasable from the internal memory, and transmit the generated initial configuration data block to be stored in the external memory, and

restore an initial configuration of the secure processor, comprising erasing data elements configured as erasable in the internal memory, receiving the initial configuration data block, and loading the data elements from the initial configuration data block in the internal memory.

22. The device according to claim 11 , wherein the secure processor is configured to keep a table up-to-date, containing for each data element loaded in the internal memory:

an identifier of the data element,

the export eligibility flag, and

an export state indicating if the data element has been erased from the internal memory and exported in a data block.

23. The device according to claim 22 , wherein the table contains authentication data for each data element in the internal memory.

Assignments (6)