Providing trusted access to a JTAG scan interface in a microprocessor
View Patent ↗A method for securing a scan chain architecture by performing an authentication operation through a trusted software layer to authorize use of a protected scan chain.
1. A method for securing a scan chain architecture, said method comprising:
disabling a scan interface in a system comprising a secure processor and a software layer, wherein said software layer is authorized to access trusted resources in said secure processor;
receiving authentication information at the software layer, wherein said authentication information if valid provides access to said scan interface;
verifying whether said authentication information is valid using said software layer; and
allowing access to said scan interface if said authentication information is valid.
2. The method of claim 1 , wherein said disabling further comprises:
disabling said scan interface upon booting up said secure processor.
3. The method of claim 1 , wherein said disabling further comprises:
setting a register to a first state that disables said scan interface, wherein said register is internal to said secure processor.
4. The method of claim 3 , wherein said allowing access to said scan interface further comprises:
setting said register to a second state that enables said scan interface.
5. The method of claim 1 , wherein said receiving said authentication information further comprises:
receiving said authentication information through a communication buffer that provides an interface to said software layer for authentication purposes, wherein said authentication information is a message.
6. The method of claim 1 , wherein said verifying said authentication information further comprises:
verifying whether said authentication information is in a proper format.
7. The method of claim 1 , wherein said verifying said authentication information further comprises:
using a public key in an asymmetric key pair to verify a signature of said authentication information, wherein said authentication information is signed by a private key from said asymmetric key pair.
8. The method of claim 1 , wherein said authentication information is encrypted.
9. The method of claim 1 , wherein said verifying said authentication information further comprises:
verifying a password.
10. The method of claim 1 , further comprising:
providing an override enable pin that controls said scan interface.
11. A system comprising:
a secure processor;
a software module operable to validate authentication information, and wherein said software module is authorized to access trusted resources in said secure processor; and
a scan interface operable to access features of said secure processor, wherein access to said scan interface is granted if said authentication information is valid.
12. The system of claim 11 , wherein said secure processor further comprises:
an internal register for granting access to said scan interface, wherein said internal register is set if said authentication information is valid.
13. The system of claim 12 further comprising:
an enable switch coupled to said internal register operable to control access to said scan interface.
14. The system of claim 11 , wherein said software module uses a public key in an asymmetric key pair to validate a signature of said authentication information, wherein said authentication information is signed by a private key from said asymmetric key pair.
15. The system of claim 11 , wherein access to said scan interface is denied by default upon bootstrapping said secure processor.
16. The system of claim 11 further comprising:
a communication buffer for receiving said authentication information, wherein said communication buffer provides an interface to said software module for authentication purposes; and
an authentication link that communicatively couples said communication buffer to said software module.
17. A computer-readable medium having stored thereon, computer-executable instructions that, responsive to execution by a computing device, cause the computing device to perform operations comprising:
disabling a scan interface of a system comprising a secure processor and a software layer, wherein said software layer is authorized to access trusted resources in said secure processor;
receiving authentication information at the software layer, wherein said authentication information if valid provides access to said scan interface;
verifying whether said authentication information is valid using said software layer; and
allowing access to said scan interface if said authentication information is valid.
18. The computer-readable medium of claim 17 , wherein said disabling further comprises:
setting a register to a first state that disables said scan interface upon booting up said secure processor, wherein said register is internal to said secure processor.
19. The computer-readable medium of claim 17 , wherein said verifying said authentication information further comprises:
verifying whether said authentication information is in a proper format.
20. The computer-readable medium of claim 17 , wherein said operations further comprise:
providing an override enable pin that controls said scan interface.