Scan design and secure chip [secure IC testing]

Abstract

Testing a secure system is often considered as a severe bottleneck. While testability requires to an increase in both observability and controllability, secure chips are designed with the reverse in mind, limiting access to chip content and on-chip controllability functions. As a result, using usual design for testability techniques when designing secure ICs may seriously decrease the level of security provided by the chip. This dilemma is even more severe as secure applications need well-tested hardware to ensure that the programmed operations are correctly executed. In this paper, a security analysis of the scan technique is performed. This analysis aims at pointing out the security vulnerability induced by using such a DfT technique. A solution securing the scan is finally proposed.

Hardware security and test: Friends or enemies?

“…If DFT cannot be avoided, it must be designed such as not to compromise the protected information. A number of techniques, such as scan chain scrambling (placing memory elements in the scan chain in an order unknown to the attacker) [27], are based on the "security by obscurity" paradigm and violate Kerckhoff's principle "the enemy knows the system". A different approach is to consistently distinguish between the test mode in which the secret information is not used and the operational mode in which the DFT circuitry is disabled.…”

PUF-based secure test wrapper design for cryptographic SoC testing

“…The scan chain scrambling technique, presented in [13], randomizes the scan chain data by performing a pseudo-random selection of scan chains to be loaded at a time through a Linear Feedback Shift Register (LFSR) and a MUXed structure. In the Lock and Key Technique [14], the scan chains are divided into a number of sub-chains.…”

Security challenges during VLSI test

“…Other countermeasures have been proposed for making scan-chain shifting not exploitable by attackers. In [8], the authors propose to scramble the scan path so that even if an attacker can dump the scan path in user mode, the data are difficult for him to interpret. In authorized test mode, the scan path is normally connected, while in user mode the scan path segments are randomly connected.…”

“…The drawback of such a solution is the additional data to be scanned from the scan path, resulting in additional test time and test data, and therefore increasing the overall test cost. Finally, a data scrambling-based solution [8], [10] imposes to specify scan segments and to add additional circuitry to drive the mechanism.…”