Secure element with shared memories, for a multi-image owner device

1. A secure element for a device intended for being used by N image owners, with N>2, comprising:

a) a first nonvolatile memory divided into N parts each part operable to store, respectively, data of said N image owners, defining notably images to be loaded wherein an image is a structure and encrypted representation of binary information,

b) a second non-volatile memory storing a primary boot loader operable to load an image or launching an operating system related to an image during a session of access of an image owner to said secure element,

c) a third non-volatile memory divided into N parts each part operable to store, respectively, image owner session private data relative to said primary boot loader,

d) a first random access memory divided into N parts associated respectively to said N parts of said first non-volatile memory,

e) a second random access memory operable to temporarily store data of an image owner during an access session,

f) a third random access memory temporarily storing private data of a first image owner during a transfer of said first image owner private data from a first random access memory first part (originator part) to a first random access memory second part (predefined destination part), and

g) a controller activated via said primary boot loader in response to said device starting an access session by sending a dedicated command, and operable to control accesses to said non-volatile memories and said random access memories according to at least one predefined rule, and operable to erase said second random access memory each time said device starts an access session.

2. The secure element according to claim 1 , wherein each rule is chosen from a group comprising a programming of said different parts that is persistent against power cycles of said non-volatile memories, a definition of the size of each part is performed once and/or is irreversible or can be reprogrammable if all parts are fully erased, a selection of a part by said controller is not persistent against a power cycle, a switching of first non-volatile memory part generates a virtual reset of peripherals of said secure element except said controller, a switching to a given first non-volatile memory part is performed via a command provided by said device, there is only one image owner access session at a given time, private data of an image owner stored into a first random access memory first part, are transferable into a first random access memory second part via the third random access memory, and in case of switch from a first non-volatile memory part to another first non-volatile memory part that is not associated to the first random access memory second part into which private data of said first non-volatile memory part are transferable via the third random access memory, then said third random access memory is erased.

3. The secure element according to claim 1 , wherein at least one of said first random access memory parts is arranged for storing at least one volatile image owner secret code.

4. The secure element according to claim 1 , wherein each rule is chosen from a group comprising a programming of said different parts that is persistent against power cycles of said non-volatile memories, a definition of the size of each part is performed once and/or is irreversible or can be reprogrammable if all parts are fully erased, a selection of a part by said controller is not persistent against a power cycle, a switching of first non-volatile memory part generates a virtual reset of peripherals of said secure element except said controller, a switching to a given first non-volatile memory part is performed via a command provided by said device, there is only one image owner access session at a given time, private data of an image owner stored into a first random access memory first part, are transferable into a first random access memory second part via the third random access memory, and in case of switch from a first non-volatile memory part to another first non-volatile memory part that is not associated to the first random access memory second part into which private data of said first non-volatile memory part are transferable via the third random access memory, then said third random access memory is erased.

5. The secure element according to claim 1 , wherein at least one of said first random access memory parts is arranged for storing at least one volatile image owner secret code.

6. The secure element according to claim 2 , wherein at least one of said first random access memory parts_stores at least one volatile image owner secret code.

7. A device intended for being used by N image owners, with N>2, comprising: at least one secure element having:

a) a first non-volatile memory divided into N parts each part operable to store, respectively, data of said N image owners, defining notably images to be loaded wherein an image is a structure and encrypted representation of binary information,

b) a second non-volatile memory arranged for storing a primary boot loader operable to load an image or launching an operating system related to an image during a session of access of an image owner to said secure element,

c) a third non-volatile memory divided into N parts each part operable to store, respectively, image owner session private data relative to said primary boot loader,

d) a first random access memory divided into N parts associated respectively to said N parts of said first non-volatile memory,

e) a second random access memory operable to temporarily store data of an image owner during an access session,

f) a third random access memory temporarily storing private data of an image owner during a transfer of said image owner private data from a first random access memory first part (originator part) to a first random access memory second part (predefined destination part), and

g) a controller activated via said primary boot loader in response to said device starting an access session by sending a dedicated command, and operable to control accesses to said non-volatile memories and said random access memories according to at least one predefined rule, and operable to erase said second random access memory each time said device starts an access session.

8. The device according to claim 7 , wherein said device is a system on chip in which said secure element is embedded.

9. The device according to claim 7 , wherein said secure element is removable.

10. The device according to claim 7 wherein each rule is chosen from a group comprising a programming of said different parts that is persistent against power cycles of said non-volatile memories, a definition of the size of each part is performed once and/or is irreversible or can be reprogrammable if all parts are fully erased, a selection of a part by said controller is not persistent against a power cycle, a switching of first non-volatile memory part generates a virtual reset of peripherals of said secure element except said controller, a switching to a given first non-volatile memory part is performed via a command provided by said device, there is only one image owner access session at a given time, private data of an image owner stored into a first random access memory first part, are transferable into a first random access memory second part via the third random access memory, and in case of switch from a first non-volatile memory part to another first non-volatile memory part that is not associated to the first random access memory second part into which private data of said first non-volatile memory part are transferable via the third random access memory, then said third random access memory is erased.

11. The device according to claim 7 , wherein each rule is chosen from a group comprising a programming of said different parts that is persistent against power cycles of said non-volatile memories, a definition of the size of each part is performed once and/or is irreversible or can be reprogrammable if all parts are fully erased, a selection of a part by said controller is not persistent against a power cycle, a switching of first non-volatile memory part generates a virtual reset of peripherals of said secure element except said controller, a switching to a given first non-volatile memory part is performed via a command provided by said device, there is only one image owner access session at a given time, private data of an image owner stored into a first random access memory first part, are transferable into a first random access memory second part via the third random access memory, and in case of switch from a first non-volatile memory part to another first non-volatile memory part that is not associated to the first random access memory second part into which private data of said first non-volatile memory part are transferable via the third random access memory, then said third random access memory is erased.

12. The device according to claim 7 wherein at least one of said first random access memory parts_stores at least one volatile image owner secret code.

13. The device according to claim 7 wherein at least one of said first random access memory parts is arranged for storing at least one volatile image owner secret code.

14. The device according to claim 10 wherein at least one of said first random access memory parts is arranged for storing at least one volatile image owner secret code.

15. An apparatus, comprising at least one device having at least one secure element having:

a) a first non-volatile memory divided into N parts each part operable to store, respectively, data of said N image owners, defining notably images to be loaded wherein an image is a structure and encrypted representation of binary information,

b) a second non-volatile memory storing a primary boot loader operable to load an image or launching an operating system related to an image during a session of access of an image owner to said secure element,

c) a third non-volatile memory divided into N parts each part operable to store, respectively, image owner session private data relative to said primary boot loader,

d) a first random access memory divided into N parts associated respectively to said N parts of said first non-volatile memory,

e) a second random access memory and arranged for temporarily storing data of an image owner during an access session,

f) a third random access memory temporarily storing private data of an image owner during a transfer of said image owner private data from a first random access memory first part (originator part) to a first random access memory second part (predefined destination part), and

g) a controller activated via said primary boot loader in response to said device starting an access session by sending a dedicated command, and operable to control accesses to said non-volatile memories and said random access memories according to at least one predefined rule, and operable to erase said second random access memory each time said device starts an access session.

16. The apparatus according to claim 15 wherein each rule is chosen from a group comprising a programming of said different parts that is persistent against power cycles of said non-volatile memories, a definition of the size of each part is performed once and/or is irreversible or can be reprogrammable if all parts are fully erased, a selection of a part by said controller is not persistent against a power cycle, a switching of first non-volatile memory part generates a virtual reset of peripherals of said secure element except said controller, a switching to a given first non-volatile memory part is performed via a command provided by said device, there is only one image owner access session at a given time, private data of an image owner stored into a first random access memory first part, are transferable into a first random access memory second part via the third random access memory, and in case of switch from a first non-volatile memory part to another first non-volatile memory part that is not associated to the first random access memory second part into which private data of said first non-volatile memory part are transferable via the third random access memory, then said third random access memory is erased.

17. The apparatus according to claim 15 , wherein at least one of said first random access memory parts is arranged for storing at least one volatile image owner secret code.