Method and system for providing trusted access to a JTAG scan interface in a microprocessor
View Patent ↗A method for securing a scan chain architecture by performing an authentication operation through a trusted software layer to authorize use of a protected scan chain.
1. A method for securing a scan chain architecture, comprising:
disabling by default a JTAG scan interface in a system comprising a secure processor and a trusted software layer that has authorized access to trusted resources in said secure processor, wherein said JTAG scan interface is capable of accessing trusted features of said secure processor;
receiving an authentication message at the trusted software layer, wherein said authentication message when valid provides access to said JTAG scan interface;
verifying said authentication message is valid using said trusted software layer; and
enabling said JTAG scan interface when said authentication message is valid using said trusted software layer.
2. The method of claim 1 wherein said disabling by default further comprises:
disabling said JTAG scan interface upon booting up said secure processor.
3. The method of claim 1 , wherein said disabling by default further comprises:
setting a register to a first state that disables said JTAG scan interface, wherein said register is internal to said secure processor.
4. The method of claim 3 , wherein said enabling said JTAG scan interface further comprises:
setting said register to a second state that enables said JTAG scan interface.
5. The method of claim 1 , wherein said receiving said authentication message further comprises:
receiving said authentication message through a communication buffer that provides an interface to said trusted software layer for authentication purposes.
6. The method of claim 1 , wherein said verifying said authentication message further comprises:
verifying said authentication message is in a proper format.
7. The method of claim 1 , wherein said verifying said authentication message further comprises:
using a public key in an asymmetric key pair to verify a signature of said authentication message, wherein said authentication message is signed by a private key from said asymmetric key pair.
8. The method of claim 1 , wherein said authentication message is encrypted.
9. The method of claim 1 , wherein said verifying said authentication message further comprises:
verifying a password.
10. The method of claim 1 , further comprising:
providing an override enable pin that controls said JTAG scan interface.
11. A system for securing a scan chain architecture, comprising:
a secure processor;
a JTAG scan interface coupled to said secure processor that is capable of accessing secure features of said secure processor;
a trusted software communicatively coupled to said secure processor for validating an authentication message, wherein said trusted software has authorized access to trusted resources in said secure processor;
a communication buffer for receiving said authentication message, herein said communication buffer provides an interface to said trusted software for authentication purposes;
an authentication link that communicatively couples said communication buffer directly to said trusted software for authentication purposes; and
a register internal to said secure processor for enabling said JTAG scan interface when properly set, wherein said trusted software enables said register when said authentication message is valid.
12. The system of claim 11 , further comprising a router for routing said authentication message to said communication buffer.
13. The system of claim 11 , wherein said JTAG scan interface is disabled by default upon bootstrapping said secure processor.
14. The system of claim 11 , wherein said trusted software uses a public key in an asymmetric key pair to validate a signature of said authentication message, wherein said authentication message is signed by a private key from said asymmetric key pair.
15. The system of claim 11 , wherein said trusted software decrypts said authentication message that is encrypted by a public key in an asymmetric key pair, said system performing encryption using a private key.
16. The system of claim 11 , further comprising:
an enable switch coupled to said register for controlling access to said JTAG scan interface.
17. The system of claim 16 , further comprising:
an override enable pin communicatively coupled to said JTAG scan interface, wherein said override enable pin enables said JTAG scan interface when properly signaled; and
an OR logic gate coupled to said enable register and to said override enable pin through inputs and to said enable switch through an output.
18. A computer system comprising:
a processor for processing information; and
a computer readable memory coupled to said processor and containing program instructions that, when executed cause said processor to implement a method for securing a scan chain architecture, comprising:
disabling by default a JTAG scan interface in a system comprising a secure processor and a trusted software layer that has authorized access to trusted resources in said secure processor, wherein said JTAG scan interface is capable of accessing trusted features of said secure processor;
receiving an authentication message at the trusted software layer, wherein said authentication message when valid provides access to said JTAG scan interface;
verifying said authentication message is valid using said trusted software layer; and
enabling said JTAG scan interface when said authentication message is valid using said trusted software layer.
19. The method of claim 18 , wherein said disabling by default further comprises:
disabling said JTAG scan interface upon booting up said secure processor.
20. The method of claim 18 , wherein said disabling by default further comprises:
setting a register to a first state that disables said JTAG scan interface, wherein said register is internal to said secure processor.
21. The method of claim 20 , wherein said enabling said JTAG scan interface further comprises:
setting said register to a second state that enables said JTAG scan interface.
22. The method of claim 18 , wherein said receiving said authentication message further comprises:
receiving said authentication message through a communication buffer that provides an interface to said trusted software layer for authentication purposes.
23. The method of claim 18 , wherein said verifying said authentication message further comprises:
verifying said authentication message is in a proper format.
24. The method of claim 18 , wherein said verifying said authentication message further comprises:
using a public key in an asymmetric key pair to verify a signature of said authentication message, wherein said authentication message is signed by a private key from said asymmetric key pair.
25. The method of claim 18 , wherein said authentication message is encrypted.
26. The method of claim 18 , wherein said verifying said authentication message further comprises:
verifying a password.
27. The method of claim 18 , further comprising:
providing an override enable pin that controls said JTAG scan interface.