Patent Application
20110185110
The invention relates generally to the protection of information contained in an integrated circuit, and more particularly, is directed to protecting such information from attacks that exploit test structures of the internal circuitry.
The manufacture of integrated circuits (IC) often requires a comprehensive test of all circuitry included on the IC to screen out any possible defects. The test should have a high fault grade to ensure high quality. A high fault grade requires that all circuitry included in the IC be both controllable and observable. During functional operation of the IC, the internal circuitry is often buried and inaccessible from the outside of the IC thus inhibiting testability. Several test techniques have been developed to make circuitry controllable and observable. The problem is that these test techniques might allow secret, confidential, proprietary, or restricted information, such as encryption keys, pass words, bank accounts, social security numbers, and other sensitive data or information, contained in data storage devices inside the IC to be inadvertently revealed to unauthorized parties.
This information may be contained in such storage devices, random access memories (RAMs), read only memories (ROMs), logic registers or non-volatile memories (NVMs), and might be revealed when unauthorized parties discover how to place the IC into test mode and read the secret information that may be stored inside. The NVMs may be Flash, EEPROM, EPROM, storage devices, or any other such non-volatile storage devices or elements. This invention describes a method and system to maintain secrecy of the information contained in an IC against possible attacks that exploit these test structures.
Several methods have been developed to aid in the comprehensive testing of integrated circuits: scan insertion, built in self-test (BIST), boundary multiplexing and JTAG (joint test action group) are examples.
Scan insertion involves replacing sequential elements with scannable sequential elements (scan cells) and then stitching those cells into scan chains. Data can be serially shifted in and out of these chains allowing these cells to be controlled and observed from outside of the IC.
BIST testing is used for higher-level storage cells such as RAMs, ROMs or other complex cells. This requires wrapping the complex cell inside circuitry that will apply a pre-determined test sequence on the inputs of the cell. In the case of a RAM this sequence will write prescribed patterns into the RAM and read the results out. In the case of a ROM, these inputs will just read out the contents. BIST also includes circuitry to compress or compare the outputs of the cell.
Boundary multiplexing may be used in certain circumstances where a cell has special test requirements that make it unsuitable for scan or BIST. This includes cells, such as NVMs, that might require analog connections during test. In this instance the inputs and outputs are multiplexed to the top-level pins on the outside of the IC allowing the automated tester to control and observe the cell directly. JTAG may also be used to provide a boundary register around this cell to allow the tester to control and observe this cell through the JTAG TAP port. Sometimes this JTAG is protected in order to prevent unauthorized outside access to information that was stored in NVM prior to entering test mode. If there is a scan chain that is also routed outside the IC via JTAG, then this technique prevents separate and parallel testing of the NVM and scan chain, which requires additional tester time.
These techniques, applied in various combinations, allow an IC to be tested thoroughly and thus achieve a high fault grade.
Prior art relies on ignorance on behalf of an attacker about the specifics of the test circuitry to maintain security of any secrets contained in the IC. Unfortunately, this cannot be guaranteed. If the IC to be tested contains encryption keys or other such secret information, the test circuitry is a tool that an attacker could use to gain access to this secret information. Prior art
In the event that direct access to the information is not available, the attacker might employ indirect methods. The IC may be run in normal functional mode until such time that the desired secret information has been transferred to register or RAM. In this case the IC can be placed in scan mode and the state of all the registers in the IC can be determined. The scan chain might also be exploited to read the data from the internal RAMs or ROMs and thus reveal any secret information contained therein.
If these methods are repeated, then an attacker can compare the various results to determine which information does not change. This may help him identify fixed items such as encryption keys that do not change.
Embodiments of the invention advantageously provide for a method of protecting information contained in an integrated circuit (IC) from being revealed during testing of the integrated circuit unless or until the information is changed or otherwise deemed safe for access, the integrated circuit having a test controller state machine (TCSM) directly or indirectly coupled to control structure and/or input and/or output of at least one data storage device, the at least one data storage device having information stored therein and the IC having at least one normal functional mode of operation and at least one testing mode of operation. The method comprises the steps of:
An embodiment of the invention also provides for an integrated circuit that comprises (a) at least one data storage device wherein said data storage device has information stored therein and the integrated circuit has at least one normal functional mode of operation and at least one testing mode of operation, and (b) a test controller state machine (TCSM) directly or indirectly coupled to at least one data storage device wherein the TCSM includes implementation means for causing the information in the at least one data storage device to be protected from outside access unless or until the at least one data storage device is deemed safe for access.
The prior art problems previously discussed are addressed by including a test controller state machine (TCSM) to prevent access to control or observe via the test structures until such time that all the protected information has been destroyed or otherwise deemed safe for access. One way to destroy information is via reset as shown in
The TCSM has a “test request” input. Upon assertion of the “test request” input the TCSM will kick off several processes depending on what test structures are contained in the IC.
One process initiates an erase cycle of the non-volatile memory (
Since the RAMs must be tested anyway, another process (
Since the various processes might take different times to complete, the TCSM will wait for all the processes to complete before it will allow the IC to go into scan open mode. Prior to entering scan open mode, the TCSM will take steps (
In order to minimize testing time for ICs, it is desired to test NVMs separately but in parallel with the scan chains. One benefit of this invention allows the NVMs to safely be tested separately and in parallel with the scan chains, especially when protected JTAG is used to route the information outside the IC. Another benefit of this invention is that the test request input can also be asserted by tamper sensing circuits to protect information in the event of a tamper attack.
A fuller understanding of the foregoing may be had by reference to the accompanying drawings, wherein:
While the invention is susceptible to embodiments in different forms, there are shown in the drawings and will be described herein, in detail, the preferred embodiments of the invention. It should be understood, however, that the present disclosure is to be considered an exemplification of the principles of the invention and is not intended to limit the spirit or scope of the invention and/or claims of the embodiments illustrated.
These problems are addressed by including a test controller state machine (TCSM) to prevent access to control or observe via the test structures until such time that all the protected information has been destroyed. Prevention of access and control is achieved by gates or similar circuits that either enable or block access as desired.
The TCSM has the characteristics of a finite state machine (FSM) or a finite state automaton (plural: automata), namely it is a model of behavior composed of a finite number of states, transitions between those states, and actions.
A state stores information about the past, i.e. it reflects the input changes from the system start to the present moment.
A transition indicates a state change and is described by a condition that would need to be fulfilled to enable the transition.
An action is a description of an activity that is to be performed at a given moment. There are several action types:
Entry action—which is performed when entering the state
Exit action—which is performed when exiting the state
Input action—which is performed depending on present state and input conditions, and
Transition action—which is performed when performing a certain transition.
In a digital circuit, an FSM may be built using such items as a programmable logic device, a programmable logic controller, logic gates and flip flops or relays. More specifically, a hardware implementation requires a register to store state variables, a block of combinational logic which determines the state transition, and a second block of combinational logic that determines the output of an FSM.
Referring to
As shown in the following table, the TCSM has four major modes. In this case, the first mode is normal functional operation of the IC and the test operation is divided into the remaining three modes. It is possible for a TCSM to have less than four modes or more than four modes, depending on user requirements.
Upon reset and/or power-up the TCSM will be in “Idle” mode. In “Idle” mode, the IC will be configured to operate in functional (non-test) mode. The RAMs, ROMs and NVMs will be connected to perform the normal function of the IC, and the scan chains will be inhibited. It is in this mode that the IC performs the normal function for which it was ultimately designed.
The TCSM has a “test request” input that will command it to prepare the IC for testing. Upon assertion of the “test request” input, the TCSM will enter “Erase” mode and will perform several processes, either sequentially or concurrently, to perform BIST on RAMs or ROMs (
During “Erase” mode, if the IC contains RAMs or ROMs the TCSM will place these devices in BIST mode. In BIST mode, the inputs to the RAMs and ROMs will be controlled by a BIST controller rather than by the circuitry that normally controls it. Referring now to
While in this mode, the RAMs and ROMs can be controlled/observed only by the BIST controller and nothing else. This condition will persist as long as the TCSM is in “Erase” mode. A RAM may be reconnected to its functional mode inputs/outputs and/or outside IC boundary after completion of BIST. At this point in time there is no longer any danger of revealing any secret information that was contained in the RAM because any data in the RAM has been overwritten during the BIST test and deemed safe for access. This allows the interface between the functional logic and the RAM to be tested. In the instance that a particular ROM doesn't contain any sensitive information, it may also safely be connected to the normal functional logic and/or outside IC boundary.
It is also imperative that the sequential elements of the BIST controller not be included in any of the scan chains in order to prevent an attacker from taking control of the BIST controller and thus circumventing its intended function.
In the event that a RAM, ROM or other cell not require BIST testing (for example if they can be verified in functional mode by a functional test) a means may be provided to prevent these cells from being controlled or observed either directly or indirectly either through the scan chains, JTAG or through any top level pin. One possible way of accomplishing this would be to provide an “AND” gate between every output of the cell and its functional destination (as shown in
Also, while the TCSM is in “Erase” mode, and if the IC contains an NVM the TCSM will first go through the process of obliterating the data in the NVM before placing it in a mode where it can be tested. The TCSM will first check to see if the NVM is already erased and deemed safe for access. If not erased, it will initiate an erase cycle of the NVM. Since an erase cycle may take several milliseconds, the TCSM has an erase timer that will cause it to wait until the desired erase time has elapsed. Once the erase timer has expired the controller will then read all the information in the NVM again to verify that it has indeed been erased and deemed safe for access. This process will repeat until the TCSM has verified that the NVM is completely erased. This prevents an attacker from clocking the circuit at a higher frequency than intended, thus short-cycling the erase timer and circumventing a full erase cycle.
Referring now to
Using those inputs the TCSM will sequentially perform the following steps:
Referring to
It is also understood that instead of erasing the NVM, all locations may be written instead to allow the NVM to be safe for access. The same process as above is followed, but with the erase cycle being replaced with a write cycle to the current location. This alternative might be preferred in some instances because writing of data to some NVMs is much quicker than erasure. In some instances, such as EPROM, the data cannot be electrically erased and therefore can only be obscured by writing. Also any writing over of information to be protected from revelation is preferably done more than once and when so written over is preferably written over using different or random write over patterns.
Since these various processes might take different times to complete, the TCSM will remain in “Erase” mode until all BIST has been completed and all NVMs have been erased before proceeding to the “Scan1” mode. At this point all RAMs and NVMs are clear of any sensitive information and therefore deemed safe for access. The scan chain, however, might still contain sensitive information.
Referring now to
From this point on, the IC is in scan test mode “Scan open”. The scan test and NVM test may now proceed as in prior art.
Various programming can implement the TCSM control and interactions described herein. Such programming can be modified as desired to block outside access to secret information contained in one or more sensitive circuits until and unless it is deemed safe to access the information. The following is an exemplary robust TCSM implementation written in Verilog:
A portion of the disclosure of this patent document contains material that is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyright rights whatsoever.
The foregoing programming contains at least one instance of the various types of circuits such as NVM, scan chains, and BIST tested circuits previously discussed. Such programming can be used “as is”, or can be modified as desired to block outside access to information contained in one or more instances of each of these types of circuits until, and unless, it is deemed safe to access the information. In this programming implementation, each of these circuits can be safely tested and re-tested as many times as desired, and whenever desired. A user may also permanently deny outside access to the information in any particular circuit by simply holding access to its information permanently blocked to reduce complexity or cost. The access prevention gates and multiplexers themselves can be implemented and controlled by the TCSM as a separate entity, but can also be incorporated inside the TCSM depending on user preference.
From the foregoing and as mentioned above, it will be observed that numerous variations and modifications may be effected without departing from the spirit and scope of the novel concept of the invention. Preventing access to control or observe information in each of these circuits is determined by system requirements and individual user preferences. It is to be understood that no limitation with respect to the specific methods and apparatus illustrated herein is intended or should be inferred. For example, the instant invention may be employed with an IC that does not have both NVM and RAM memory as the IC may only include a NVM without a RAM memory portion or vice versa. It is, of course, intended to cover by the appended claims all such modifications as fall within the scope of the claims.
The embodiments of the method for protecting information contained in an integrated circuit and the disclosed integrated circuit advantageously protects information contained in a data storage device of integrated circuit from being revealed by attacks that exploit test structures of the internal circuitry.
This application claims priority to U.S. Provisional Patent Application 60/940,896 filed May 30, 2007.
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/US08/65183 | 5/30/2008 | WO | 00 | 2/16/2011 |
| Number | Date | Country | |
|---|---|---|---|
| 60940896 | May 2007 | US |
