A Secure JTAG Wrapper for SoC Testing and Debugging

Abstract

IEEE Std. 1149.1, also known as the Joint Test Access Group (JTAG) standard, provides excellent controllability and observability for ICs and hence is widely used in IC testing, debugging, failure analysis, or even online chip control/monitoring. Unfortunately, it has also become a backdoor for attackers to manipulate the ICs or grab confidential information from the ICs. One way to address this problem is to disable JTAG pins after manufacturing testing. However this countermeasure prohibits the in-filed testing and debugging capability. Other countermeasures such as authentication and encryption/decryption methods based on specific static keys have also been proposed. However, these approaches may suffer from side-channel or memory attacks that may figure out the specific keys. This paper presents an authenticationbased secure JTAG wrapper with a dynamic feature to defend against the attacks mentioned above. We generate different keys for different test data dynamically. Therefore, only legal test data can be updated to the test data registers (TDRs) through JTAG. Furthermore, the attackers will get fake responses if they shift in illegal test data, which makes it extremely difficult to break our proposed method. We can also employ the physical unclonable function (PUF) to distinguish the legal test data for different chips. Experiments on a RISC-V CPU processor called SCR1 show that our proposed method can have an area overhead of only 0.49%. INDEX TERMSHardware security, IEEE test standard security, JTAG security, memory attack, secure JTAG wrapper, physical unclonable function (PUF), in-field testing, in-field debugging. SHIH-CHUN YEH received the B.S. degree in electrical engineering from the National Chung Cheng University, Chiayi, Taiwan, in 2019. He is currently pursuing the M.S. degree in electrical engineering from the National Cheng Kung University, Tainan, Taiwan. His current research interests include hardware security, security of IEEE test standards, and security of testing.

A Novel Clock Gating Approach for the Design of Low-Power Linear Feedback Shift Registers

“…In [22], to further reduce the power consumption of the extra gates, the authors proposed a single CMOS XORNAND gate to drive the clock terminals of the FFs. The power dissipation was estimated in 𝑃 𝐺𝐶 [22] ≈ 𝑛𝛼𝑃 𝐹𝐹 ′ + 𝑛 𝑡 𝛼𝑃 𝑋𝑂𝑅 + 𝑛𝛼𝑃 𝑋𝑂𝑅𝑁𝐴𝑁𝐷 (4) but, the reduction in the overall power dissipation with respect to a traditional (non-gated clock) LFSR was no better than 10%, thus limiting the benefit of the proposed topology.…”

Era of Sentinel Tech: Charting Hardware Security Landscapes Through Post-Silicon Innovation, Threat Mitigation and Future Trajectories

“…It provides good observability and controllability for users to access the Test Data Registers (TDRs) and Boundary-Scan Cells (BSCs) through the Test Access Port (TAP). As a result, users can test and debug ICs using a variety of techniques, including post-silicon debugging, chip reconfiguration, verification, power management, and clock control [40].…”

Cultivating Security: Debug Authentication for Ensuring the Security of SoC's Root of Trust

“…In these methods, a secure debug architecture is equipped with stream or block ciphers to protect the data flow during the debug process [18] [17]. In addition, researchers have also proposed password-based methods to ensure secure debugging through authentication [12] using a dynamic or pre-defined password. One step ahead are techniques that use challenge-response protocols such as physically unclonable functions (PUFs) to protect the security of the debug process.…”