Methods and apparatus for using scan operations to protect secure assets
Methods and apparatus are disclosed to protect secure assets using scan operations. One example apparatus includes logic circuitry including a scan chain that includes data storage elements and design logic coupled to the scan chain. The example apparatus also includes data storage to store secure data. The design logic is coupled to the data storage. The example apparatus also includes a security controller to transition the apparatus out of a secure mode of operation. The transition includes the security controller to cause the scan chain to serially shift secure scan data from an input of the scan chain into each data storage element of the data storage elements of the scan chain.
1 . A system, comprising:
data storage configured to store secure data;
logic circuitry including:
design logic configured to access the secure data stored in the data storage during a secure mode; and
a plurality of scan chains coupled to the design logic, each of the plurality of scan chains including a plurality of data storage elements coupled in series; and
a security controller configured to:
cause the design logic to transition out of the secure mode, wherein to transition out of the secure mode, the security controller is configured to:
select a subset of scan chains out of the plurality of scan chains based on a determination that the subset of scan chains includes at least one non-resettable flip-flop; and
cause the plurality of data storage elements of the selected subset of scan chains, not a remainder of the plurality of scan chains, to serially shift scan data that is separate from the secure data through the plurality of data storage elements.
2 . The system of claim 1 , wherein the scan data includes data of a predetermined value.
3 . The system of claim 2 , wherein the predetermined value is binary 0.
4 . The system of claim 1 , wherein the security controller is configured to provide the scan data to the selected subset of scan chains at least until a portion of the scan data is detected at an output of the selected subset of scan chains.
5 . The system of claim 1 , wherein:
the selected subset of scan chains includes one or more scan chains; and
the security controller is configured to cause the plurality of data storage elements of each of the selected subset of scan chains to serially shift the scan data through the plurality of data storage element of a scan chain.
6 . The system of claim 1 , wherein to the transition out of the secure mode, the security controller is configured to disable the access, by the design logic, to the secure data.
7 . The system of claim 1 , wherein the security controller is configured to provide the scan data to the selected subset of scan chains for at least a threshold time period.
8 . The system of claim 1 , wherein the security controller is configured to select the selected subset of scan chains based on the design logic being associated with at least a portion of the secure data.
9 . The system of claim 1 , wherein the security controller is configured to select the selected subset of scan chains based on a determination that the design logic includes at least one non-resettable flip-flop.
10 . The system of claim 1 , wherein the system is a system-on-a-chip (SoC).
11 . The system of claim 1 , wherein the plurality of data storage elements of the selected subset of scan chains includes a plurality of flip-flops.
12 . The system of claim 11 , wherein the plurality of flip-flops includes a plurality of D flip-flops.
13 . The system of claim 1 , wherein to the transition out of the secure mode, the security controller is configured to gate an output of the system to prevent the secure data shifted out of the plurality of data storage elements of the selected subset of scan chains from exiting the system.
14 . The system of claim 1 , wherein the data storage includes at least one of a read only memory, a random access memory, or a register.
15 . A system, comprising:
design logic configured to access secure data during a secure mode;
a plurality of scan chains coupled to the design logic, each of the plurality of scan chains including a plurality of data storage elements coupled in series; and
a security controller configured to:
transition the design logic out of the secure mode, wherein to transition out of the secure mode, the security controller is configured to:
select a subset of scan chains out of the plurality of scan chains based on a determination that the subset of scan chains includes at least one non-resettable flip-flop; and
provide scan data of a predetermined value to serially shift through the plurality of data storage elements of the selected subset of scan chains, not a remainder of the plurality of scan chains.
16 . The system of claim 15 , wherein the plurality of data storage elements of the selected subset of scan chains includes a plurality of flip-flops.
17 . The system of claim 15 , wherein the predetermined value is binary 0.
18 . A method, comprising:
transitioning, by a security controller, a design logic of an integrated circuit into a secure mode to access secure data stored in the integrated circuit, wherein the design logic is coupled to a plurality of scan chains, wherein each of the plurality of scan chains includes a set of data storage elements coupled in series, and wherein one of the design logic or the set of data storage elements includes a non-resettable data storage element; and
transitioning, by the security controller, the design logic out of the secure mode, which includes:
selecting a subset of scan chains out of the plurality of scan chains based on a determination that the subset of scan chains includes at least one non-resettable flip-flop;
disabling the access of the design logic to the secure data; and
providing data of a predetermined value to serially shift through the set of data storage elements of the selected subset of scan chains, not a remainder of the plurality of scan chains.
19 . The system of claim 15 , wherein:
the selected subset of scan chains includes one or more scan chains; and
the security controller is configured to cause the plurality of data storage elements of each of the selected subset of scan chains to serially shift the scan data through the plurality of data storage element of a scan chain.
20 . The system of claim 15 , wherein the security controller is configured to provide the scan data to the selected subset of scan chains for at least a threshold time period.