Patent Description:
The secure processing sub-system, or secure processing element, or secure element, is a secure area that is for example part of an integrated circuit. It may include a separate processor or CPU (central processing unit), one or more memories, hardware means and/or software means to implement cryptographic functions such as encryption and/or decryption algorithm(s), signature and/or verification algorithm(s), an interface with the integrated circuit to send and receive data and/or commands to and from the integrated circuit, buses to connect the external memory via the integrated circuit. A power source and a clock generator provide power and a clock signal to the integrated circuit.

The secure processing sub-system may be implemented on an integrated circuit such as a system-on-chip (SoC), a chip or other similar device having a processor or CPU and one or more memories.

The amount of memory available in the secure processing sub-system may be limited. In some cases, the amount of the memory available in the integrated circuit is also limited due to the small size of the integrated circuit. As a result, the secure processing sub-system may use a non-volatile memory (NVM) that is external to the secure processing sub-system, and/or external to the integrated circuit, to store data. The confidentiality and the authenticity of the data stored in the external non-volatile memory may be ensured by the use of encryption, integrity and authentication mechanisms.

The data stored in the external non-volatile memory may undergo updates while the system is powered on. These updates may be followed up, for example in a volatile memory.

The power supply to the system may be temporarily interrupted, due to a power loss from the power source. Such a situation may occur when a battery used as the power source is being discharged or is removed.

An attacker may try to replace the current version of the data stored in the external non-volatile memory by an old copy of the data that is validly encrypted and authenticated, for example signed, by the secure processing sub-system, for example during a power interruption. Such an attack is referenced as a rollback or playback attack. It may allow the attacker to gain access to the secure processing sub-system and/or have the secure processing sub-system to perform an unauthorized action.

<CIT> discloses a computing device comprising:.

The secure processing subsystem has a volatile memory and a non-volatile memory, such as an OTP (one-time programmable) memory.

The volatile memory is used by the secure processing subsystem to store and maintain the data while power is supplied to the secure processing subsystem. In the event that power supply is lost or interrupted, the content of the volatile memory is lost. The secure processing sub-system maintains and updates data in the volatile memory but needs to offload the data to the external memory, that may be required later or for persistent storage, in the event of a power loss from the external power source.

For that purpose, the secure processing subsystem has an internal power source that is used as a secondary power source for providing power in the event that power from the external power source is lost. It can comprise a capacitor, a battery, or other device that can store electrical power and power the secure processing sub-system at least for a short period of time in the event of a power loss from the external power source.

Furthermore, an anti-replay counter ARC is used to prevent replay attacks on data stored in the external memory by the secure processing sub-system. The ARC value is maintained in the volatile memory of the secure processing sub-system while power is provided from the external power source. But, in an event indicative that power provided from the external power source has been lost or power loss is imminent, the ARC value is written from the volatile memory of the secure processing sub-system to the non-volatile memory of the secure processing sub-system. The internal power source provides the secure processing sub-system with sufficient power to allow it to write the current ARC value stored in the volatile memory into the internal non-volatile memory.

In <CIT>, the secure processing sub-system of the computing device uses the ARC value to prevent attacks in which an attacker attempts to place data expired but otherwise valid in the external memory in an attempt to gain access to the secure processing sub-system and have the secure processing sub-system to perform some unauthorized action. To avoid replay attacks, the SoC relies on the ARC. When the computing device is powered on, the processor of the secure processing sub-system retrieves the ARC value from its internal non-volatile memory and stores the ARC value in its volatile memory. The ARC value is maintained in the volatile memory and updated each time data is written to the external memory, until a triggering event occurs that causes the processor of the secure processing sub-system to update the ARC value in the internal non-volatile memory with the current ARC value stored in the volatile memory. The ARC value in the volatile memory of the secure processing sub-system follows the updates of the data stored in the external memory. The triggering event indicates that the power from the external power source has been lost or may be lost. When the computing device is powered on again, the authenticity of the data stored in the external memory is checked by the secure processing sub-system using the ARC value stored in its internal non-volatile memory.

The approach disclosed in <CIT> requires a secure detection of the triggering event and an internal power source with high security requirements. The technical implementation needs to be robust since all the power off events must be detected and the internal power source should be protected against any malicious attack. Furthermore, the addition of an internal power source in a secure processing sub-system is expensive and requires more space on the integrated circuit. Documents <CIT> and <CIT> disclose replay protection systems using power loss detection units.

Therefore, there is a need for improving the situation. More precisely, there is a need to avoid a rollback or playback attack in a system including:.

The present disclosure concerns a method performed by a system including.

during each power cycle where data stored in the external non-volatile memory is updated, the secure processing sub-system executes a transaction by performing the following steps :.

A power cycle corresponds to a period while power is supplied from the power source to the system elements from the time the system is powered on and until the system is powered off.

In each power cycle where data stored in the external non-volatile memory is updated, a transaction is started in the internal non-volatile memory. In the event of an imminent power interruption or power loss, a signal may be transmitted to the secure processing sub-system indicating that the power supply is going to be interrupted. Shortly before the power interruption, the secure processing sub-system ends or commits the transaction in the internal non-volatile memory.

In case that the device is attacked, it is very likely that a signal indicating that power is going to be interrupted is not sent to the secure processing sub-system. As a result, the secure processing sub-system does not end properly the current transaction in the internal non-volatile memory. At the time that the device is next powered on, the secure processing system checks the transaction status in its internal non-volatile memory and, if a transaction is still pending, the secure processing sub-system cannot trust the data stored in the external non-volatile memory and consequently prevents to use them. The present transaction-based mechanism allows to prevent a rollback and replay attack consisting in using an old version of the data stored in the external memory, which may be validly encrypted and/or authenticated.

In the present disclosure, it is assumed that, in normal circumstances, there is no attack and the transaction can be properly closed shortly before the power interruption. But, when there is an attack, the attack can be detected later based on the transaction status that remains pending. For example, during an attack, the battery may suddenly be removed, and the secure processing sub-system does not have time to end the transaction in the internal non-volatile memory. As a result, the transaction remains pending in the internal non-volatile memory. At the time that the system is powered on again, it is detected that a transaction is still pending. Consequently, the content of the external non-volatile memory is no longer trusted and used by the secure processing sub-system. The secure processing sub-system may still use internal functions and continue to operate.

In an embodiment, at the end of each power cycle where the data stored in the external non-volatile memory is updated, the secure processing sub-system writes into the internal non-volatile memory a version information of the updated data stored in the external non-volatile memory before ending the transaction.

In that case, at the beginning of any power cycle, after verifying that there is no pending transaction in the internal non-volatile memory, the secure processing sub-system verifies that the version of the data stored in the external non-volatile memory matches the version information in the internal non-volatile memory and, in a negative event, prevents to use the data stored in the external non-volatile memory.

If there is no pending transaction when the system is powered on, the secure processing sub-system performs another security check on the data stored in the external non-volatile memory by verifying if the version of the data stored in the external non-volatile memory corresponds to the data version information stored in the internal non-volatile memory. This allows to guarantee that the version of the data stored in the external memory is not an old version.

In an embodiment, at the end of the power cycle where the data stored in the external non-volatile memory is updated, the secure processing sub-system increments a version counter in the internal non-volatile memory and writes the version counter value into the external non-volatile memory. The use of a version counter in the internal non-volatile memory to follow the versions of the data stored in the external non-volatile memory allows to minimize the wear of the internal non-volatile memory.

In another embodiment, at the end of the power cycle where the data stored in the external non-volatile memory is updated, the secure processing sub-system computes a condensed representation of the updated data stored in the external non-volatile memory and writes said condensed representation into the internal non-volatile memory and into the external non-volatile memory.

In a first embodiment, the secure processing sub-system controls to.

In a second embodiment, in each power cycle where the data stored in the external non-volatile memory is updated, the secure processing sub-system controls to.

The external non-volatile memory may have a first area and a second area, and, at the beginning of any power cycle, if a transaction is still pending, the secure processing sub-system may only prevent to use the data stored in the first area of the external non-volatile memory.

The secure processing sub-system can start and end a transaction in its internal non-volatile memory in different ways.

In a first example of implementation, the secure processing sub-system:.

and, at the beginning of any power cycle:.

In a second example of implementation, the secure processing sub-system:.

In a third example of implementation, the secure processing sub-system:.

The present disclosure also concerns a system including.

The present disclosure further concerns a computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out the steps of the method previously defined.

The present disclosure provides a transaction-based anti-replay or anti-rollback mechanism for a system including.

The secure processing sub-system may be implemented on an integrated circuit. It may be a secure area of the integrated circuit. Optionally, the non-volatile memory may be external to the integrated circuit.

Power supply to the system is provided by a power source. The power source may be external to the assembly, or system, comprising the secure processing sub-system and the external non-volatile memory. This assembly or system is supplied by the power source during power cycles between which power is interrupted. Any power cycle is started when the system (assembly) is powered on and ended when the system (assembly) is powered down or off. Each power cycle corresponds to a period while power is supplied from the power source to the system elements from the time the system is powered on and until the system is powered off.

The secure processing sub-system, that may be implemented on an integrated circuit, uses the external NVM to store data. The data stored in the external NVM may be updated over time during the power cycles. The anti-replay mechanism can be used to prevent rollback or replay attacks on the data stored in the external NVM. Indeed, an attacker may attempt to restore an old version of the data to the external NVM which is validly authenticated (for example validly signed), and/or encrypted by the secure processing sub-system in a rollback or replay attack. The present disclosure concerns an additional protection for the data stored in the external NVM. Accordingly, during each power cycle where the data is updated, a transaction processing is started upon a first update of the data within this power cycle, by writing a first transaction data in the internal NVM. At the end of this power cycle, for example upon reception of a signal indicating that a power interruption is imminent, in case updated data must be kept in the external NVM, one or more required writing actions are performed to update the internal NVM and, if needed, the external NVM in accordance with the current version of the updated data. Then, the transaction processing is committed, in other words validated or closed, by writing a second transaction data in the internal non-volatile memory. After the power interruption, when the system is next powered on, the secure processing sub-system checks if a transaction processing is still pending, in other words not committed or not closed, in the internal NVM. If no transaction processing is pending in the internal NVM, the version of the data (in other words the freshness of the data) that is stored in the external non-volatile memory can be trusted and used by the secure processing sub-system. In that case, the data stored in the external non-volatile memory can be further verified by checking the integrity, authenticity and/or confidentiality of the data by means of well-known verification algorithms. If a transaction processing is still pending in the internal NVM, which means that the last transaction did not end correctly, the version of the data stored in the external NVM cannot be trusted and used by the secure processing sub-system. In such a case, it is assumed that an attack may have been attempted and, for security reasons, the data stored in the external NVM is not trusted and consequently not used to prevent any rollback or playback attack.

<FIG> shows a functional block diagram of a computing system <NUM>, or computing device, including an integrated circuit <NUM>, a secure processing sub-system <NUM> implemented on the integrated circuit <NUM>, an external non-volatile memory (NVM) <NUM>, and a power source <NUM>.

The power source <NUM> powers the system <NUM>, and may be external to the integrated circuit <NUM>. It may comprise a battery or any other equipment for providing electrical power to the components of the integrated circuit <NUM>.

The secure processing sub-system <NUM> may provide a secure execution environment, with a high level of security, including hardware and/or software means for implementing functions such as cryptographic functions and/or algorithms for example for encryption, decryption and/or authentication. The secure processing sub-system <NUM> may comprise a processor or CPU <NUM>, and one or more cryptographic accelerators <NUM>, or co-processors, designed to perform cryptographic operations.

Furthermore, the secure processing sub-system <NUM> may have a software, or program instructions, component or module <NUM> to control the execution of a transaction processing, during each power cycle where data is updated, and of a process of verifying if a transaction is still pending in the internal NVM <NUM> and, in a positive event, preventing to use the data stored in the external NVM <NUM>, as described later in the description of the method. The software <NUM> may run on the CPU <NUM> of the secure processing sub-system <NUM>.

The secure processing sub-system <NUM> may comprise a non-volatile memory <NUM>, such as an OTP (One Time Programmable) memory. The non-volatile memory <NUM> is a persistent memory that maintains the data stored therein even in case of power interruption to the secure processing sub-system <NUM>. The non-volatile memory <NUM> of the secure processing sub-system <NUM> is not limited to an OTP memory. It could be any other type of non-volatile memory, such as a MTP (multi-time programmable) memory or a flash memory.

In addition, optionally, the secure processing sub-system <NUM> may include a volatile memory <NUM> that may be used as a working memory.

The secure processing sub-system <NUM> can also have an integrated circuit interface <NUM> to communicate with the integrated circuit <NUM> in order to send and receive data and/or commands. Buses (not represented) can also be provided in the secure processing sub-system <NUM>.

The integrated circuit <NUM> may be a system-on-chip (SOC), also referenced as a chip. As shown in <FIG>, it may include a processor or CPU <NUM>, hardware and/or software elements to implement one or more functions and/or applications represented by functional blocks <NUM> in <FIG>. The functions and/or applications implemented on the integrated circuit <NUM> may depend on the functionality of the sub-system <NUM> or system <NUM>.

The non-volatile memory (NVM) <NUM> is external to the secure processing sub-system <NUM>. Optionally, it may be external to the integrated circuit <NUM>. For example, it may be a flash memory. It may be connected to the secure processing sub-system <NUM> either directly or via the integrated circuit <NUM>. This external NVM <NUM> is used by the secure processing sub-system <NUM> to store data in a persistent manner, even in case of power interruption. The data may include any type of data such as information or code. The nature of the data may depend on the functionality of the system <NUM> and/or the applications, functions, operations executed by the system <NUM>. As example, the data can include an operating system, JAVA-OS, SIM applications, operator profiles, network authentication keys, IoT applications, etc.. These examples are only illustrative and non-limitative. In another embodiment, the non-volatile memory <NUM> could be implemented on the integrated circuit <NUM>, preferably outside the secure processing sub-system <NUM>.

Optionally, the system <NUM> may further comprise a volatile memory <NUM> used during the power cycles for the data updates, as described in more details later. The volatile memory <NUM> may be external to the integrated circuit <NUM>. Alternatively, the volatile memory <NUM> could be implemented on the integrated circuit <NUM>, preferably outside the secure processing sub-system <NUM>.

Optionally, the system <NUM> may have an external memory <NUM> including one part or area of non-volatile memory, corresponding to the NVM <NUM>, and one part or area of volatile memory, corresponding to the volatile memory <NUM>.

As previously indicated, the external NVM <NUM> is used by the secure processing sub-system <NUM> to store data. The data, stored in the external NVM <NUM>, may be updated over time in some power cycles. The updates of the data may be monitored using the volatile memory <NUM> and/or the volatile memory <NUM>, while the system <NUM> is powered. However, the content of the volatile memories <NUM> and <NUM> is erased or lost, when the power supply to the system <NUM> is interrupted. In case of power interruption, to persist the updated data in memory (in other words for persistent storage of the updated data), one or more writing actions to the internal NVM <NUM> and, if needed, to the external NVM memory <NUM> are performed, before interrupting the power supply and erasing the volatile memories <NUM> and/or <NUM>, as described later in more details.

In a first embodiment, the data that is stored in the external NVM <NUM> may be copied into the volatile memory <NUM> at the beginning of each power cycle, and then maintained and updated in the volatile memory <NUM> during the power cycle. At the end of the power cycle, shortly before the power interruption, the updated data is written from the volatile memory <NUM> to the external non-volatile memory <NUM>. In some cases, it is not desired to persist in memory, or keep in a persistent memory, all the updated data, but only a part of the updated data. In such cases, only the updated data to persist in memory may be written from the volatile memory to the external non-volatile memory <NUM>.

In a second embodiment, the data may be maintained and updated in the external NVM <NUM> during the power cycles. Indeed, it is possible to update the data in the external NVM <NUM>.

The programming time in a non-volatile memory is higher than in a volatile memory. Furthermore, using the external NVM <NUM> to store all the updates of the data, including transient updates, leads to a faster wear of the non-volatile memory <NUM>. So, it is more relevant technically to use the volatile memory to update the data during the power cycles, according to the first embodiment, so as to spare the external non-volatile memory and reduce programming time.

<FIG> is a flowchart <NUM> of a data updating process, according to an embodiment, performed during a power cycle Ci.

Let's consider that, in the present embodiment, at the beginning of the power cycle Ci, the data initially stored in the non-volatile memory <NUM> is copied into the volatile memory <NUM>. Then, during the power cycle Ci, the data is maintained and updated within the volatile memory <NUM>. In other embodiments, the non-volatile memory <NUM> of the secure processing sub-system <NUM> may be used to store, maintain and update the data from the non-volatile memory, in addition to or instead of the volatile memory <NUM>.

A first update of the data within the power cycle Ci, in a step <NUM>, triggers the secure processing sub-system <NUM> to start a transaction processing. The transaction processing is started by writing to the internal NVM <NUM> a first transaction data, or start transaction data, marking the start of the transaction, in a step <NUM>.

Then, during the power cycle Ci, the data may undergo one or more further updates, represented by a step <NUM>. It should be noted that at least part of the updates may be transient updates. The data is updated within the volatile memory <NUM>, in the step <NUM>. The updates of the data in the volatile memory <NUM> may be done by the processor or CPU <NUM> of the integrated circuit <NUM>. The secure processing sub-system <NUM> may prepare and secure the updated data in confidentiality, integrity, authenticity and freshness.

In a step <NUM>, a power interruption is imminent. The secure processing sub-system <NUM> may be informed of this event by the integrated circuit <NUM>. For example, the integrated circuit <NUM> may receive a signal from a battery controller indicating that a power loss from the battery <NUM> is imminent when the battery charge level is below a predefined threshold, and informs the secure processing sub-system <NUM>.

The step <NUM> is a triggering event to perform a step <NUM> of executing different actions of writing to the internal non-volatile memory <NUM> and to the external non-volatile memory <NUM> so as to update them in accordance with the updated data that needs to persist in memory during the power interruption. The step <NUM> may be performed by the secure processing sub-system <NUM>, and/or by the integrated circuit <NUM> under control of the secure processing sub-system <NUM>. The writing actions to update the internal and external non-volatile memories <NUM>, <NUM> are illustrated in <FIG> and explained below:.

The version counter <NUM> has the function of counting the power cycles with update of the data in the external non-volatile memory <NUM>. It means that:.

Thus, in operation, the version counter <NUM> may be incremented once at the end of each power cycle with update of the data stored in the external NVM <NUM>. The version counter <NUM> does not need to be incremented each time the data is updated. It is sufficient that the version counter <NUM> counts the power cycles with update of the data stored in the external NVM <NUM>.

The updated data that is stored in the external non-volatile memory <NUM> in the step <NUM> corresponds to a certain version of the data. The value of the version counter <NUM> corresponds to a version value for the data version stored in the external NVM <NUM>.

For security reasons, the data stored in the external NVM <NUM> may be cryptographically encrypted and authenticated. Furthermore, the data may be stored in the external NVM <NUM> in association with metadata containing information on the stored data. The metadata may be cryptographically encrypted and/or authenticated. The authentication mechanism used for the data may be a hash-based signature, a block cipher based message authentication or an asymmetric cryptography based signature. In that case, the message authentication code and/or the signature is included in the metadata. More generally, the metadata may include any type of authentication data (also referenced as an integrity figure), such as a signature, a hash, a hash MAC, a digital fingerprint, etc.. , allowing to verify the integrity and/or authenticity of the data stored in the external non-volatile memory <NUM>. The counter value, also referenced as the data version value, or stored in the internal NVM <NUM> may be included in the authentication process and may also be added in the metadata.

Any other type of version information representative of the version of the updated data stored in the external NVM <NUM> could be used. For example, the version information of the data stored in the external NVM <NUM> may include a condensed representation of the data stored in the external NVM, such as a hash value, a hash MAC, a digital fingerprint, etc.. The condensed representation of data corresponds to an integrity figure representing the data. At the end of the power cycle with update of the data stored in the external NVM <NUM>, the secure processing sub-system <NUM> may compute the condensed representation of the updated data stored in the external NVM <NUM>, and store, or write, this condensed information into the internal NVM <NUM> and into the external NVM <NUM>.

After completion of all the required writing actions <NUM>, <NUM>, <NUM> to update the internal and external non-volatile memories <NUM>, <NUM> in the step <NUM>, the transaction processing is closed, or committed, by writing a second transaction data, or end transaction data, marking the end of the transaction, in the internal NVM <NUM>, in a step <NUM>.

Finally, in a step <NUM>, the power supply is interrupted, which marks the end of the power cycle Ci.

The steps <NUM> to <NUM> are executed for each power cycle where the data stored in the non-volatile memory <NUM> is updated.

There are different ways to write the first transaction data and the second transaction data marking the start and the end of a transaction processing, in the internal NVM <NUM>, in the steps <NUM> and <NUM>. The description below gives different examples of implementation. However, these examples are only illustrative and non-limitative.

In a first example of implementation, the secure processing sub-system <NUM>:.

In a second example of implementation, the secure processing sub-system <NUM>:.

In a third example of implementation, the secure processing sub-system <NUM>:.

The transaction processing is executed by the secure processing sub-system <NUM> during each power cycle where the data stored in the external non-volatile memory <NUM> is updated. It is started at a first update of the data and ended, or committed, after execution of required writing actions to update the internal non-volatile memory <NUM> and, if needed, the external non-volatile memory <NUM>. The required writing actions may include writing updated data from the volatile memory <NUM> to the external non-volatile memory <NUM>, writing a version information of the updated data stored in the volatile to the internal non-volatile memory <NUM>, adding the same version information to the data stored in the external non-volatile memory <NUM>, for example in metadata.

A process <NUM> of starting a power cycle according to an embodiment is illustrated in <FIG> and will now be described. This process may be executed each time the system <NUM> is power on, after a power interruption.

In <FIG>, in a step <NUM>, the system <NUM> is powered on by the power source <NUM>, after a power interruption.

In a next step <NUM>, the secure processing sub-system <NUM> verifies if a transaction is still pending in the internal non-volatile memory <NUM>. A pending transaction is a transaction that has been started in a previous power cycle, but has not been closed or committed. In such a situation, the internal non-volatile memory <NUM> contains the first transaction data for the pending transaction, but fails to contain a second transaction data corresponding to, or consistent with, this first transaction data.

There are different ways to verify if a transaction is still pending in the internal non-volatile memory <NUM>, depending on how the first transaction data and the second transaction data have been written into the internal NVM <NUM>. Different examples of implementation for starting and ending a transaction processing have been previously described. It is described below how the secure processing sub-system <NUM> verifies if a transaction is still pending at the beginning of each power cycles, in these different examples of implementation.

In the first example of implementation with two transaction counters in the internal NVM <NUM>, to verify if a transaction is still pending, the secure processing sub-system <NUM> compares the value of the first transaction counter and the value of the second transaction counter in the internal non-volatile memory <NUM> to check if a transaction executed during a previous power cycle is still pending. If the respective values of the two transaction counters are consistent with each other, typically identical, there is no pending transaction. In other words, the previous transaction has been committed. If the respective values of the two transaction counters are different, a transaction is still pending. In that case, the version of the data stored in the external non-volatile memory <NUM> is not trusted anymore and the data stored in the external non-volatile memory <NUM> will not be used. If there is no pending transaction, the secure processing sub-system <NUM> can use the data stored in the external non-volatile memory <NUM>.

In the second example of implementation with one single transaction counter in the internal NVM <NUM>, to verify if a transaction is still pending, the secure processing sub-system <NUM> verifies the even or odd character of the counter value to check if a transaction executed during a previous power cycle is still pending.

In the third example of implementation based on a value table, the secure processing sub-system <NUM> verifies that the transaction start value of the previous power cycle and the associated transaction end value are both written in the internal non-volatile memory <NUM> to check if a transaction executed during a previous power cycle is still pending.

If a transaction is still pending, the version of the data stored in the external non-volatile memory <NUM> is not trusted anymore by the secure processing sub-system <NUM>, and the process goes to a countermeasure step <NUM> to prevent to use the data stored in the external non-volatile memory <NUM>. In such a situation, the secure processing sub-system <NUM> considers that the data stored in the external non-volatile memory may have been replayed, due to a replay attack, or modified and cannot be trusted by the secure processing sub-system <NUM>.

If there is no pending transaction in the step <NUM>, the secure processing sub-system <NUM> can proceed with subsequent security checks related to the data stored in the external NVM <NUM>.

Optionally, the secure processing sub-system <NUM> may verify the integrity and/or authenticity of the data stored in the external NVM <NUM>, by verifying the signature or any other authentication and/or integrity element present in the metadata associated with the data, in a well-known manner, in a step <NUM>.

If the integrity or authenticity check <NUM> fails, the process goes to a countermeasure step <NUM>.

The secure processing sub-system <NUM> may also verify the version of the data stored in the external NVM <NUM>, in a step <NUM>, by checking if the version information stored in the internal non-volatile memory <NUM> matches the version of the data stored in the external non-volatile memory <NUM> in a step <NUM>. For that purpose, the secure processing sub-system <NUM> may compare the version information present in the internal NVM <NUM> with the version information present in the external NVM <NUM> in association with the data stored therein, for example in the metadata associated with the stored data. As previously described, in an embodiment, the version information includes the value of a version counter <NUM> stored in the internal NVM <NUM>. In another embodiment, the version information may include a condensed representation of the data stored in the external NVM <NUM>. In any case, the version information present in the external NVM <NUM> should correspond to the version information stored in the internal NVM <NUM>.

If the data version verification fails in the step <NUM>, the process goes to a countermeasure step <NUM> to prevent to use the data stored in the external non-volatile memory <NUM>. In such a situation, in other words in case the version information in the internal NVM <NUM> does not match the version of the data stored in the external NVM <NUM>, the secure processing sub-system <NUM> considers that the data stored in the external non-volatile memory <NUM> may have been replayed, due to a replay attack.

If the data version of the data stored in the external NVM is successfully verified in the step <NUM>, the secure processing sub-system <NUM> starts using the data stored in the external non-volatile memory <NUM>. If the data is encrypted, the secure processing sub-system <NUM> decrypts the encrypted data. In an embodiment, the data stored in the external NVM <NUM> may also be copied into the volatile memory <NUM> to be used and updated by the secure processing sub-system <NUM> during the power cycle.

As previously explained, the process <NUM> of starting the power cycle may result in the execution of a countermeasure step in one of the following situations:.

In the countermeasure steps <NUM>, <NUM>, <NUM>, the secure processing sub-system <NUM> executes a countermeasure to prevent the use of the data stored in the external NVM <NUM>, because the data cannot be trusted. For example, a countermeasure may consist in erasing the untrusted data from the external NVM <NUM>, or in simply prohibiting the use of the external NVM <NUM>. This can lead to a non-functional system.

Alternatively, the external NVM <NUM> may have a first area and a second area, and only the first area is protected by the transaction-based anti-replay mechanism of the present disclosure. Thus, at the beginning of any power cycle, if it is detected in one of the steps <NUM>, <NUM>, <NUM>, that the data stored in the first area cannot be trusted, the secure processing sub-system only prevents to use the data stored in the first area of the external non-volatile memory. For example, when the system <NUM> is powered on after a power interruption and a transaction is still pending, only the first area is invalidated and its content can no longer be used, while the second area remains valid and its content can still be used. The second area may be protected using another anti-replay mechanism. For example, the first area could be designed to store data which is updated very often (e.g., telco counters), and the second area could be designed to store data less often updated (e.g., firmware).

As previously indicated, in an embodiment, the data may be maintained and updated in the external NVM <NUM> during the power cycles, instead of being copied and updated in the volatile memory <NUM>. In that case, optionally, at every update of the data in the external NVM <NUM>, a data version information may be updated and written into a volatile memory, for example in the volatile memory <NUM> or in the volatile memory <NUM> of the secure processing sub-system <NUM>, and stored in the external NVM <NUM> in association with the data stored therein, for example in the associated metadata, under control of the secure processing sub-system <NUM>. Then, in case of an imminent power off, at the end of the power cycle, the secure processing sub-system <NUM> writes the current version information from the volatile memory <NUM> or <NUM> into the internal NVM <NUM>.

The method of the present disclosure is a computer-implemented method.

Claim 1:
A method performed by a system (<NUM>) including
i) a secure processing sub-system (<NUM>) having an internal non-volatile memory (<NUM>),
ii) a non-volatile memory (<NUM>) that is external to the secure processing sub-system (<NUM>); wherein
during each power cycle where data stored in the external non-volatile memory is updated, the secure processing sub-system executes a transaction by performing the following steps :
. writing a first transaction data marking the start of the transaction in the internal non-volatile memory upon a first update of the data within the power cycle, and
. at the end of the power cycle, writing a second transaction data marking the end of said transaction to the internal non-volatile memory,
and, at the beginning of any power cycle, the secure processing sub-system (<NUM>) performs the steps of
. checking (<NUM>) if a transaction is still pending in the internal non-volatile memory (<NUM>) based on the transaction data written in the internal non-volatile memory (<NUM>); and
. if a transaction is still pending, preventing to use the data stored in the external non-volatile memory (<NUM>).