Securing proprietary functions from scan access
View Patent ↗An electronic device as described herein implements a scheme to secure a data mapping function from scan access. The protection scheme can be used as a security measure for proprietary lookup tables, secret constants, digitally implemented algorithms, and the like. The electronic device employs a reconfigurable data mapping arrangement that can be reconfigured for a normal operating mode and a scan testing mode. While in the normal operating mode, a normal data mapping arrangement generates valid output data in accordance with the data mapping function. While in the scanning mode, however, a scanning data mapping arrangement generates invalid but testable output data in accordance with a data masking function that conceals, hides, masks, or obfuscates the data mapping function. Using the data masking function in this manner protects the data mapping function against reverse engineering attacks that attempt to derive the data mapping function from scan testing results.
1. A method of securing a data mapping function in an electronic device that employs a normal data mapping arrangement to carry out the data mapping function during a normal operating mode, wherein the normal data mapping arrangement comprises a first data mapping module and a second data mapping module in a first combined arrangement that is configured to carry out the data mapping function during the normal operating mode, the method comprising:
receiving a configuration signal to initiate scan testing; and
in response to the configuration signal, reconfiguring the normal data mapping arrangement into a scanning data mapping arrangement for a scanning mode by arranging the first data mapping module and the second data mapping module in a second combined arrangement that is configured to carry out a data masking function during the scanning mode, the scanning data mapping arrangement being configured to scan protect the data mapping function while allowing scan testing of the electronic device.
2. The method of claim 1 , further comprising scan testing at least a portion of the electronic device.
3. The method of claim 2 , wherein scan testing at least a portion of the electronic device comprises scan testing the scanning data mapping arrangement.
4. The method of claim 2 , further comprising reverting to the normal data mapping arrangement at completion of scan testing.
5. The method of claim 1 , further comprising:
in the normal operating mode, generating first digital outputs from respective digital inputs using the normal data mapping arrangement, the first digital outputs being generated in accordance with the data mapping function; and
in the scanning mode, generating second digital outputs from respective digital inputs using the scanning data mapping arrangement, the second digital outputs being generated in accordance with a data masking function that alters the data mapping function.
6. The method of claim 1 , further comprising:
in the normal operating mode, generating first digital outputs from respective digital inputs using the first combined arrangement, the first digital outputs being generated in accordance with the data mapping function; and
in the scanning mode, generating second digital outputs from respective digital inputs using the second combined arrangement, the second digital outputs being generated in accordance with the data masking function.
7. In an electronic device configured to generate digital outputs from respective digital inputs in accordance with a data mapping function, a method of securing the data mapping function from scan access, the method comprising:
in a normal operating mode of the electronic device, implementing the data mapping function with a normal data mapping arrangement by implementing a first data mapping module and a second data mapping module in a first combined arrangement that is configured to carry out the data mapping function during the normal operating mode; and
in a scanning mode of the electronic device:
implementing a data masking function with a scanning data mapping arrangement by arranging the first data mapping module and the second data mapping module in a second combined arrangement that is configured to carry out the data masking function during the scanning mode; and
scan protecting the data mapping function with the data masking function while allowing scan testing of the electronic device.
8. The method of claim 7 , further comprising:
receiving a configuration signal to initiate scan testing of the electronic device; and
in response to the configuration signal, reconfiguring the normal data mapping arrangement into the scanning data mapping arrangement.
9. The method of claim 8 , further comprising scan testing at least a portion of the electronic device.
10. The method of claim 9 , wherein scan testing at least a portion of the electronic device comprises scan testing the scanning data mapping arrangement.
11. The method of claim 9 , further comprising reverting to the normal data mapping arrangement at completion of scan testing.
12. The method of claim 7 , further comprising:
in the normal operating mode, generating first digital outputs from respective digital inputs using the normal data mapping arrangement, the first digital outputs being generated in accordance with the data mapping function; and
in the scanning mode, generating second digital outputs from respective digital inputs using the scanning data mapping arrangement, the second digital outputs being generated in accordance with the data masking function.
13. The method of claim 12 , wherein the data masking function is influenced by the data mapping function.
14. An electronic device comprising:
a reconfigurable data mapping module, comprising:
a first data mapping module comprising first hardware-based logic elements configured to receive a digital input, and to carry out a data mapping function on the digital input, resulting in a first digital output; and
a second data mapping module comprising second hardware-based logic elements configured to receive the digital input, and to generate a second digital output in response to the digital input; and
a combining module coupled to the first data mapping module and the second data mapping module, the combining module being configured to output the first digital output during the normal operating mode, and to output a digital scan output during the scanning mode, the digital scan output being influenced by the first digital output and the second digital output; and
a control module that controls the reconfigurable data mapping module, the control module being controllable to arrange the reconfigurable data mapping module into a normal data mapping arrangement for a normal operating mode, and to arrange the reconfigurable data mapping module into a scanning data mapping arrangement for a scanning mode;
in the normal operating mode, the normal data mapping arrangement being configured to receive digital inputs and generate respective digital outputs in accordance with a data mapping function; and
in the scanning mode, the scanning data mapping arrangement being configured to receive digital scan inputs and generate respective digital scan outputs in accordance with a data masking function that protects the data mapping function from scan access while allowing scan testing of the electronic device.
15. An electronic device, comprising:
a reconfigurable data mapping module, comprising:
a first data mapping module comprising first hardware-based logic elements configured to generate a first digital output in response to its respective digital input; and
a second data mapping module comprising second hardware-based logic elements configured to generate a second digital output in response to its respective digital input; and
a combining module coupled to the first data mapping module and to the second data mapping module, the combining module being configured to generate a combined output that is influenced by the first digital output and the second digital output; and
a control module that controls the reconfigurable data mapping module, the control module being controllable to arrange the reconfigurable data mapping module into:
a normal data mapping arrangement during a normal operating mode, the normal data mapping arrangement being configured to receive digital inputs and generate respective digital outputs in accordance with a data mapping function; or
a scanning data mapping arrangement during a scanning mode, the scanning data mapping arrangement being configured to receive digital scan inputs and generate respective digital scan outputs in accordance with a data masking function that protects the data mapping function from scan access while allowing scan testing of the electronic device.
16. The electronic device of claim 15 , wherein:
in the normal operating mode, the combining module generates the combined output in accordance with the data mapping function; and
in the scanning mode, the combining module generates the combined output in accordance with the data masking function.
17. The electronic device of claim 15 , wherein the reconfigurable data mapping arrangement is configured to perform data encryption.