IEEE 1149.1, commonly known as the joint test action group (JTAG), is the standard for the test access port and the boundary-scan architecture. The JTAG is primarily utilized at the time of the integrated circuit (IC) manufacture but also in the field, giving access to internal subsystems of the IC, or for failure analysis and debugging. Because the JTAG needs to be left intact and operational for use, it inevitably provides a "backdoor" that can be exploited to undermine the security of the chip. Potential attackers can then use the JTAG to dump critical data or reverse engineer IP cores, for example. Since an attacker will use the JTAG differently from a legitimate user, it is possible to detect the difference using machine-learning algorithms. A JTAG protection scheme, SLIC-J, is proposed to monitor user behavior and detect illegitimate accesses to the JTAG. Specifically, JTAG access is characterized using a set of specifically-defined features, and then an on-chip classifier is used to predict whether the user is legitimate or not. To validate the effectiveness of the approach, both legitimate and illegitimate JTAG accesses are simulated using the OpenSPARC T2 benchmark. The results show that the detection accuracy is 99.2%, and the escape rate is 0.8%.

No abstract

No abstract

Security is becoming an essential problem for integrated circuits (ICs). Various attacks, such as reverse engineering and dumping on-chip data, have been reported to undermine IC security. IEEE 1149.1, also known as JTAG, is primarily used for IC manufacturing test but inevitably provides a "backdoor" that can be exploited to attack ICs. Encryption has been used extensively as an effective mean to protect ICs through authentication, but a few weaknesses subsist, such as key leakage. Signature-based techniques ensure security using a database that includes known attacks, but fail to detect attacks that are not contained by the database. To overcome these drawbacks, a two-layer learning-based protection scheme is proposed. Specifically, the scheme monitors the execution of JTAG instructions and uses support vector machines (SVM) to identify abnormal instruction sequences. The use of machine learning enables the detection of unseen attacks without the need for key-based authentication. The experiments based on the OpenSPARC T2 platform demonstrate that the proposed scheme improves the accuracy of detecting unseen attacks by 50% on average when compared to previous work.