Test point-enhanced hardware security
Various aspects of the disclosed technology relate to techniques of using control test points to enhance hardware security. The design-for-security circuitry reuses control test points, a part of design-for-test circuitry. The design-for-security circuitry comprises: identity verification circuitry; scrambler circuitry coupled; and test point circuitry. The test point circuitry comprises scan cells and logic gates The identify verification circuitry outputs an identity verification result to the scrambler circuitry to enable/disable control test points of the test point circuitry through the logic gates, and the scrambler circuitry outputs logic bits for loading the scan cells to activate/inactivate the control test points through the logic gates.
1. An integrated circuit, comprising:
identity verification circuitry configured to generate an identity verification result for an access to the integrated circuit;
test point circuitry comprising scan cells and logic gates, the test point circuitry configured to inject specific logic values at control test points inserted into the integrated circuit; and
scrambler circuitry coupled to the identity verification circuitry and the test point circuitry, the scrambler circuitry comprising a pseudorandom pattern generator and the scrambler circuitry configured to:
in a test operation mode:
enable or disable the control test points and the scan cells according to a testing signals provided for a test of the integrated circuit;
in a mission operation mode:
responsive to a valid identity verification result from the identity verification circuitry, disable the control test points through the logic gates such that the control test points are transparent to functionality of the integrated circuit; and
responsive to an invalid verification result from the identity verification circuitry, enable the control test points through the logic gates and activate the control test points through a scan line wherein, when a given control test point is activated, the given control test point injects a specific logic value at the control test point,
wherein the scrambler circuitry is configured to provide the scan line to the scan cells of the test point circuitry as a pseudorandom value generated by the pseudorandom pattern generator such that the pseudorandom value provided as the scan line selectively activates and deactivates different control test points in the test point circuitry in the mission mode.
2. The integrated circuit recited in claim 1 , wherein the identity verification circuitry comprises a block cipher, a stream cipher, a hash function module or a physical unclonable function (PUF).
3. The integrated circuit recited in claim 1 , wherein the pseudorandom pattern generator is a randomly-seeded linear-feedback shift register.
4. The integrated circuit recited in claim 1 , wherein the pseudorandom pattern generator is a weighted pseudorandom pattern generator.
5. The integrated circuit recited in claim 1 , wherein the scrambler circuitry further comprises a clock cycle counter that controls a rate at which the scrambler circuitry activates the control test points responsive to the invalid verification result from the identity verification circuitry.
6. The integrated circuit recited in claim 5 , wherein the scrambler circuitry controls the rate at which the control test points are activated by asserting a scan cell enable signal to the scan cells after a pre-defined number of clock cycles set by the clock cycle counter.
7. The integrated circuit recited in claim 1 , wherein the scan line is directly shifted into the scan cells.
8. One or more non-transitory computer-readable media storing computer-executable instructions for causing one or more processors to insert circuitry into a circuit design, the circuitry comprising:
identity verification circuitry configured to generate an identity verification result for an access to the integrated circuit;
test point circuitry comprising scan cells and logic gates, the test point circuitry configured to inject specific logic values at control test points inserted into the integrated circuit; and
scrambler circuitry coupled to the identity verification circuitry and the test point circuitry, the scrambler circuitry comprising a pseudorandom pattern generator and the scrambler circuitry configured to:
in a test operation mode:
enable or disable the control test points and the scan cells according to a testing signals provided for a test of the integrated circuit;
in a mission operation mode:
responsive to a valid identity verification result from the identity verification circuitry, disable the control test points through the logic gates such that the control test points are transparent to functionality of the integrated circuit; and
responsive to an invalid verification result from the identity verification circuitry, enable the control test points through the logic gates and activate the control test points through a scan line wherein, when a given control test point is activated, the given control test point injects a specific logic value at the control test point,
wherein the scrambler circuitry is configured to provide the scan line to the scan cells of the test point circuitry as a pseudorandom value generated by the pseudorandom pattern generator such that the pseudorandom value provided as the scan line selectively activates and deactivates different control test points in the test point circuitry in the mission mode.
9. The one or more non-transitory computer-readable media recited in claim 8 , wherein the identity verification circuitry comprises a block cipher, a stream cipher, a hash function module or a physical unclonable function (PUF).
10. The one or more non-transitory computer-readable media recited in claim 8 , wherein the pseudorandom pattern generator is a randomly-seeded linear-feedback shift register.
11. The one or more non-transitory computer-readable media recited in claim 8 , wherein the pseudorandom pattern generator is a weighted pseudorandom pattern generator.
12. The one or more non-transitory computer-readable media recited in claim 8 , wherein the scrambler circuitry further comprises a clock cycle counter that controls a rate at which the scrambler circuitry activates the control test points responsive to the invalid verification result from the identity verification circuitry.
13. The one or more non-transitory computer-readable media recited in claim 12 , wherein the scrambler circuitry controls the rate at which the control test points are activated by asserting a scan cell enable signal to the scan cells after a pre-defined number of clock cycles set by the clock cycle counter.
14. The one or more non-transitory computer-readable media recited in claim 8 , wherein the scan line is directly shifted into the scan cells.
15. A method, comprising:
generating an invalid identity result by identity verification circuitry in an integrated circuit responsive to an unauthorized access to the integrated circuit, and responsive to generation of the invalid identity result:
using the invalid identity result to enable control test points of test point circuitry by scrambler circuitry, the scrambler circuitry comprising a pseudorandom pattern generator; and
loading, by the scrambler circuitry, a scan line to scan cells associated with the control test points to selectively activate the control test points based on the scan line, wherein loading the scan line to the scan cells comprises loading a pseudorandom value generated by the pseudorandom pattern generator as the scan line such that the pseudorandom value provided as the scan line selectively activates and deactivates different control test points in the test point circuitry.
16. The method recited in claim 15 , wherein the identity verification circuitry comprises a block cipher, a stream cipher, a hash function module or a physical unclonable function (PUF).