Method and system for protecting processors from unauthorized debug access
View Patent ↗A method for securing a scan test architecture by performing an authentication operation to authorize use of a protected scan chain.
1. A method for securing a scan test architecture, comprising:
disabling by default a protected scan chain of a scan test interface in an integrated circuit;
performing an authentication operation to authorize use of said protected scan chain, said performing said authentication operation comprises:
providing a control scan chain of elements;
comparing said control scan chain of elements against a plurality of secret key values, said plurality of secret key values is a random number; and
enabling said protected scan chain when said authentication operation is successful.
2. The method of claim 1 , wherein said performing an authentication operation further comprises:
authorizing use of said protected scan chain when said control scan chain of elements correctly corresponds to said plurality of secret key values.
3. The method of claim 2 , wherein said comparing said control scan chain of elements further comprises:
performing a XOR logic operation for each element in said control scan chain with a corresponding secret key value to obtain a plurality of values;
performing at least one AND logic operation on said plurality of values to generate a control signal; and
determining said authentication operation is successful when said control signal is high.
4. The method of claim 3 , wherein said enabling said protected scan chain further comprises:
enabling a clock signal for said protected scan chain when said control signal is high.
5. The method of claim 2 , wherein said authorizing use of said protected scan chain further comprises:
authorizing use of said protected scan chain when each of said control scan chain of elements is a modulo twos complement of a corresponding key value in said plurality of key values.
6. The method of claim 2 , wherein said authorizing use of said protected scan chain further comprises:
authorizing use of said protected scan chain when each of said control scan chain of elements is an inverse of a corresponding key value in said plurality of key values.
7. The method of claim 2 , wherein said plurality of secret key values comprises a plurality of fused values within said scan test architecture.
8. The method of claim 1 , wherein said plurality of secret key values is encrypted.
9. The method of claim 1 , wherein said scan test interface comprises a JTAG scan test interface.
10. An integrated circuit capable of securing a scan test architecture, comprising:
an unprotected control scan chain;
a plurality of secret key values, wherein said control scan chain is used to authenticate use of a protected scan chain of said integrated circuit;
a plurality of XOR logic blocks for performing an XOR logic operation on each element of said unprotected control scan chain and a corresponding secret key value to obtain a plurality values;
at least one AND logic block for performing an AND logic operation on said plurality of values to generate a control signal; and
a control block for controlling said protected scan chain of a scan test interface using said control signal.
11. The integrated circuit of claim 10 , wherein said control block disables a clock signal for said protected scan chain in its default state.
12. The integrated circuit of claim 10 , wherein said control scan chain is configured to accept input values, such that when values of said control scan chain are inverses of corresponding values of said plurality of secret key values said control signal is high.
13. The integrated circuit of claim 12 , wherein said control block enables a clock signal for said protected scan chain when said control signal is high.
14. The integrated circuit of claim 10 , wherein said control scan chain is configured to accept input values, such that when values of said control scan chain are not inverses of corresponding values of said plurality of secret key values said control signal is low.
15. The integrated circuit of claim 10 , wherein said control block disables a clock signal for said protected scan chain when said control signal is low.
16. A computer system comprising:
a processor for processing information; and
a computer readable memory coupled to said processor and containing program instructions that, when executed cause said processor to implement a method for securing a scan test architecture, comprising:
disabling by default a protected scan chain of a scan test interface in an integrated circuit;
performing an authentication operation to authorize use of said protected scan chain, said performing said authentication operation comprises:
providing a control scan chain of elements;
comparing said control scan chain of elements against a plurality of secret key values, said plurality of secret key values comprises a plurality of fused values within said scan test architecture; and
enabling said protected scan chain when said authentication operation is successful.
17. The computer system of claim 16 , wherein said performing an authentication operation in said method further comprises:
authorizing use of said protected scan chain when said control scan chain of elements correctly corresponds to said plurality of secret key values.
18. The computer system of claim 17 , wherein said comparing said control scan chain of elements in said method further comprises:
performing a XOR logic operation for each element in said control scan chain with a corresponding secret key value to obtain a plurality of values;
performing at least one AND logic operation on said plurality of values to generate a control signal; and
determining said authentication operation is successful when said control signal is high.
19. The computer system of claim 18 , wherein said enabling said protected scan chain in said method further comprises:
enabling a clock signal for said protected scan chain when said control signal is high.
20. The computer system of claim 17 , wherein said authorizing use of said protected scan chain in said method further comprises:
authorizing use of said protected scan chain when each of said control scan chain of elements is a modulo twos complement of a corresponding key value in said plurality of key values.
21. The computer system of claim 17 , wherein said authorizing use of said protected scan chain in said method further comprises:
authorizing use of said protected scan chain when each of said control scan chain of elements is an inverse of a corresponding key value in said plurality of key values.
22. The computer system of claim 16 , wherein said plurality of secret key values is a random number.
23. The computer system of claim 16 , wherein said plurality of secret key values is encrypted.
24. The computer system of claim 16 , wherein said scan test interface comprises a JTAG scan test interface.
25. A method for securing a test architecture on an integrated circuit, said integrated circuit includes a secret key value, said method comprising:
disabling by default a protected portion of said test architecture;
performing an authentication operation to authorize use of said protected portion, said performing said authentication operation comprises:
comparing a candidate value to said secret key value; and
enabling said protected portion when said candidate value correctly corresponds to said secret key value.
26. The method of claim 25 , wherein said integrated circuit comprises a second secret key value.
27. The method of claim 26 , wherein said performing said authentication operation further comprises:
comparing said candidate value to said second secret key value.
28. The method of claim 25 , wherein said protected portion comprises a protected scan chain.
29. The method of claim 25 , wherein said secret key value is encrypted.
30. The method of claim 25 , wherein said secret key value is random.
31. An integrated circuit comprising:
a key storage element for storing a secret key value;
a test architecture comprising a protected test chain; and
an authentication logic coupled to receive a candidate value and said secret key value, said authentication logic coupled to said protected test chain, said authentication logic for enabling said protected test chain when said candidate value correctly corresponds to said secret key value.
32. The integrated circuit of claim 31 , wherein said secret key value comprises a random number.
33. The integrated circuit of claim 31 , wherein said secret key value comprises a unique value.
34. The integrated circuit of claim 31 , wherein said secret key value comprises a value unique to each instance of said integrated circuit.
35. The integrated circuit of claim 31 , wherein said secret key value is encrypted.
36. A integrated circuit comprising:
a test architecture having a protected portion;
an authentication logic coupled to receive a candidate value and a secret key value, said authentication logic coupled to said protected portion, wherein said authentication logic for implementing a method for securing said test architecture comprising:
disabling by default said protected portion of said test architecture;
performing an authentication operation to authorize use of said protected portion, said performing said authentication operation comprises:
comparing a candidate value to said secret key value; and
enabling said protected portion when said candidate value correctly corresponds to said secret key value.
37. The integrated circuit of claim 36 wherein said protected portion comprises a protected scan chain.
38. The integrated circuit of claim 36 wherein said secret key value comprises a random number.
39. The integrated circuit of claim 36 wherein said secret key value comprises a value unique to each instance of said integrated circuit.
40. The integrated circuit of claim 36 wherein said secret key value is stored using non-volatile storage.
41. The integrated circuit of claim 40 wherein said non-volatile storage comprises a fuse.