Method and device for secure test port authentication
A device includes a first test port coupled to a first test device, a second test port coupled to a second test device, a resource, and a security controller coupled to the first and second test ports. The security controller is operable to authenticate the first test device prior to authenticating the second test device, and, in response to authenticating the first test device, permit the first and second test devices to access the first resource.
1. A method comprising:
receiving at a first debug port of a data processing device a first authentication request, the first authentication request being received prior to a second debug port of the data processing device being authenticated to access a first resource of the data processing device;
in response to receiving the first authentication request, initiating a first authentication operation at an authentication module, wherein the first authentication operation authenticates access to the first resource by the first debug port and by the second debug port, wherein the first authentication operation comprises:
sending a first challenge from the authentication module to the first debug port;
receiving a first response at the authentication module from the first debug port, the first response responsive to the first challenge;
providing first information from the authentication module to authenticate access to the first resource by the first debug port and by the second debug port, in response to determining that the first response is a first valid response; and
providing the first information from the authentication module to authenticate access to the first resource by the first debug port and by the second debug port in response to determining that the first response is a second valid response;
receiving at the second debug port of the data processing device a second authentication request, the second authentication request being received prior to the first debug port being authenticated to access the first resource; and
in response to receiving the second authentication request, initiating a second authentication operation at the authentication module, wherein the second authentication operation authenticates access to the first resource by the first debug port and by the second debug port.
2. The method of claim 1 , wherein access to a second resource by the first debug port or by the second debug port is not authenticated in response to the first valid response, and
performing a third authentication operation at the authentication module in response to receiving an authentication request at the first debug port subsequent to providing the first information, and authenticating access to the second resource by the first debug port in response to determining that a second valid response has been received from the first debug port.
3. The method of claim 2 , wherein authentication access to the second resource by the second debug port is not provided in response to the third authentication operation determining the second valid response has been received.
4. The method of claim 2 , wherein authentication access to the second resource by the second debug port is also provided in response to the third authentication operation determining the second valid response has been received.
5. The method of claim 1 , wherein the second authentication operation further comprises:
sending a second challenge from the authentication module to the second debug port;
receiving a second response at the authentication module from the second debug port, the second response responsive to the second challenge; and
providing the first information from the authentication module to authenticate access to the first resource by the first debug port and by the second debug port, in response to determining that the first response is the first valid response.
6. The method of claim 5 , further comprising:
providing second information from the authentication module to authenticate access to a second resource by the first debug port but not by the second debug port, in response to determining that the first response is the second valid response.
7. A method comprising:
providing a first address mapped access request to a first address from a first debug port of an integrated circuit, the integrated circuit including a plurality of resources mapped to a first address space, the plurality of resources including an authentication module that is address mapped to the first address of the first address space;
initiating a first authentication operation at the authentication module to authenticate access to a first resource by the first debug port in response to the first address mapped access request being received at the authentication module by virtue of the authentication module being address mapped to the first address;
receiving at the first debug port a debug access request from a test device prior to providing the first address mapped access request to the first address; and
providing the first address mapped access request to the first address is in response to receiving the debug access request.
8. The method of claim 7 , wherein the first authentication operation is to further authenticate access to the first resource by a second debug port in response to the first address mapped access request.
9. The method of claim 8 , further comprising:
subsequent to authenticating the first debug port to access the first resource, providing a second address mapped access request to the first address from the first debug port; and
initiating a second authentication operation at the authentication module to authenticate access to a second resource in response to the second address mapped access request.
10. The method of claim 9 , wherein the second authentication operation authenticates access to the second resource by the first debug port and does not provide access to the second resource by the second debug port.
11. The method of claim 9 , wherein the second authentication operation authenticates access to the second resource by the first debug port and access to the second resource by the second debug port.
12. The method of claim 7 , wherein the debug access request from the test device includes the first address.
13. The method of claim 7 , wherein the debug access request from the test device does not include the first address.
14. The method of claim 13 , wherein the debug access request includes an instruction identifier that is decoded by the first debug port into the first address mapped access request.
15. A device comprising:
a first test port;
a second test port;
a first resource; and
a security controller coupled to the first test port and to the second test port; and
wherein the security controller:
authenticates a first test device coupled to the first test port prior to authenticating a second test device coupled to the second test port, wherein in authenticating the first test device, the security controller:
sends a challenge to the first debug port;
receives a response from the first debug port; and
provides information to authenticate access to the first resource by the first debug port and by the second debug port, in response to determining that the first response is a first valid response; and
in response to authenticating the first test device, permits the first test device and the second test device to access the first resource.
16. The device of claim 15 , wherein the security controller further:
authenticates the second test device prior to authenticating the first test device; and
in response to authenticating the second test device, permits the first test device and the second test device to access the first resource.
17. The device of claim 15 , further comprising:
a third test port; and
wherein the security controller further:
authenticates the first test device prior to authenticating a third test device coupled to the third test port; and
in response to authenticating the first test device, permits the first test device and the third test device to access the first resource.
18. The device of claim 15 , wherein the first test port includes a boundary scan architecture port.