Secure semiconductor device and secure system

Abstract

A security system includes a data port, a network-on-chip (NoC) module, a processor communicatively coupled to the NoC module, a communication interface operatively coupled to the processor and the data port, an electronic field-programmable gate array (eFPGA) configuration module operatively coupled to the NoC module, and a clock operatively coupled to the NoC module. In a first mode, the communication interface is at least partially disabled. In a second mode, the communication interface is at least partially disabled, boundary scan operation is disabled, a reset signal is held constant, and / or the redacted code is rendered inoperable. In a third mode, the communication interface is at least partially enabled to send and receive commands and data via the data port, boundary scan operation is enabled, the reset signal is not held constant, and / or the redacted code is operable.

Description

Technical Field

[0001] The present disclosure relates to semiconductors and semiconductor systems, and more particularly, to secure semiconductor and system designs. Prior Art

[0002] Design for test (DFT), also known as design for testability, involves design techniques for integrated circuits and semiconductor components that provide testability features for devices. These added features make it easier to develop and apply manufacturing tests to the hardware. Manufacturing tests, specifically tailored to the device design, are used to verify that the hardware is free of manufacturing defects that could adversely affect the product's proper operation. These tests can also be used by customers for further verification, diagnostics, and maintenance, for example.

[0003] JTAG (named after the Joint Test Action Group, which compiled it) is an industry standard for verifying designs and testing printed circuit boards after manufacture. JTAG specifies the use of a dedicated serial communication test interface on semiconductor devices. This interface connects to an on-chip test access port (TAP), which implements a state protocol to access a set of test registers representing the chip's logic levels and the functionality of various parts of the device. During operation, the JTAG interface is used to read and write data to various components of the device, facilitating system testing, diagnosis, and fault isolation. In some cases, the device can be analyzed at the machine instruction level or at the high-level code level, providing an external view of the device's internal configuration without requiring prior design knowledge. Summary of the Invention

[0004] and Simple diagram description

[0005] [ FIG. 1 ] is a block diagram of an exemplary security system according to an embodiment of the present disclosure.

[0006] [ FIG. 2 ] is a block diagram of a safety device of the system of FIG. 1 according to an embodiment of the present disclosure.

[0007] [FIG. 3] is a block diagram showing several modes of the safety device of FIGs. 1 and 2 according to an embodiment of the present disclosure.

[0008] [ FIG. 4 ] is a flowchart of an exemplary process of enabling and disabling the communication interface of the device of FIG. 2 according to an embodiment of the present disclosure.

[0009] [ FIG. 5 ] is a flowchart of an exemplary process of operating the apparatus of FIG. 2 according to an embodiment of the present disclosure. [ FIG.

[0010] [ FIG. 6 ] is a flowchart of an exemplary process of boundary scan and clock control of the apparatus of FIG. 2 according to an example of the present disclosure. [ FIG.

[0011] Although the following will be described in detail with reference to illustrative embodiments, many alternatives, modifications, and variations thereof will be apparent in light of this disclosure. Implementation Method

[0012] According to an embodiment of the present disclosure, a security system is provided. The system includes a data port, a network on chip (NoC) module, a processor communicatively coupled to the NoC module, a communication interface operably coupled to the processor and the data port, an electronic field programmable gate array (eFPGA) configuration module operably coupled to the NoC module, and a clock operably coupled to the NoC module. In a first mode, the communication interface is at least partially disabled. In a second mode, the communication interface is at least partially disabled, boundary scan operation is disabled, a reset signal is held in a constant state, and / or redacted code is rendered inoperable. In a third mode, the communication interface is at least partially enabled to send and receive commands and data via the data port, boundary scan operation is enabled, the reset signal is not held in a constant state, and / or redacted code is operable. As discussed in further detail below, many other embodiments and variations of the system will be apparent. General Overview

[0013] System-on-Chip (SoC) devices can use one or more signal buses to route signals between various on-chip modules, components, and circuit blocks within a given chip. Due to the nature of typical applications for such devices, executing on-chip commands between integrated components in existing devices is relatively insecure. For example, existing devices may be used in larger systems deployed within secure environments, making intra-chip communication security measures unnecessary or of low value. However, there are growing concerns that system-level integrated circuit chips or chipsets could be compromised by bad actors intent on accessing security information, reverse engineering circuit designs, disrupting functionality, or otherwise gaining unauthorized access to SoC devices during manufacturing or upon unauthorized access.

[0014] As mentioned above, one way to access SoC devices is through the JTAG communication channel. JTAG is designed to facilitate device, board, and system testing, diagnosis, and fault isolation. For example, JTAG is used to access sub-blocks of an integrated circuit (IC), making it a powerful debugging mechanism for embedded systems that may not have any other debug-capable communication channels. In some designs, JTAG-based debugging is available starting with the first instruction after a CPU reset, providing access to all instructions executed by the device. On-chip debug modules can be used to evaluate the device directly at the machine instruction level or in high-level language source code. In particular, JTAG allows device programmer hardware to transfer data to internal non-volatile device memory (e.g., complex programmable logic devices, or CPLDs). Some device programmers serve the dual purpose of programming and debugging the device. In the case of FPGAs, volatile memory devices can also be programmed via the JTAG port. In addition, internal monitoring functions (temperature, voltage, and current) can be accessed via the JTAG port.

[0015] Given the above, it's clear that DFT solutions using JTAG are powerful and useful for verifying semiconductors in the foundry. However, the increasing complexity of ICs, supporting multiple functions and mixed technologies, has increased the cost of having foundries capable of producing such devices, including those at 7 nanometers (nm) and below. Consequently, the number of foundries capable of producing complex devices has dwindled to just a few.

[0016] As a result, only a handful of high-end commercial foundries now produce high-performance, mixed-system ICs for multiple customers worldwide, and therefore they are typically not trusted or controlled by any individual design company. Untrusted foundries can present security vulnerabilities in the manufacturing process. For example, if a design is manufactured at an untrusted foundry beyond the customer's control, the foundry could exploit the device's JTAG functionality for reverse engineering, circuit modification, and intellectual property (IP) theft. In some cases, untrusted foundries could misuse licensed ICs and provide excess devices to adversaries or competitors without the customer's knowledge or permission, or in violation of International Traffic in Arms Regulations (ITAR) or other regulations. These devices could then be used by adversaries or competitors for purposes that pose security or financial risks to businesses or nations. For at least these reasons, there is growing concern that existing designs are insufficient to prevent or mitigate the unauthorized use or forensic detection of such devices.

[0017] As an extension of DFT, various security solutions have been developed to help mitigate reverse engineering, circuit modification, and IP theft of semiconductor devices. Examples of security solutions include logic encryption, gate layout camouflage, password protection, and the use of dummy CPLD code to prevent the foundry from accessing certain aspects of the design. However, these solutions may prevent the foundry from performing manufacturing verification, in which all produced wafers are shipped to the client for internal verification. Furthermore, malicious actors can still subvert existing security measures in various ways without the client's knowledge.

[0018] To this end, and in accordance with examples of the present disclosure, a security architecture is disclosed. This security architecture protects semiconductor device designs during manufacturing and protects the semiconductor devices from side-channel attacks during operation. For example, embodiments of the present disclosure provide a security block that can protect designs from unauthorized use, reverse engineering, and overproduction (e.g., illegally produced wafers). Some exemplary embodiments protect the security device from side-channel attacks via JTAG, reclocking, Trojan attacks on data storage elements, and restrictions on FPGA configuration access and modification. Some other exemplary embodiments protect the security device from overproduction by disabling boundary scan operations and / or by asserting a RESET signal to prevent wafer operation. Numerous other embodiments and variations will be appreciated in light of this disclosure. security system

[0019] FIG1 is a block diagram of an exemplary security system 100 according to examples of the present disclosure. System 100 may represent various circuit blocks or modules within a SoC and / or multi-die package. Thus, the various circuit blocks described herein may be implemented using integrated circuits fabricated on a single die, across multiple dies within the same die package, or across multiple dies within different die packages.

[0020] The system includes a signal bus 102 configured to route signals between various circuit blocks or other components of system 100, including at least one security device 112. Various other circuit blocks or components can be coupled to one or more ports of signal bus 102, such as processor 104, memory 106, or network I / O circuitry 108. Any other circuits or other signal buses can be coupled to signal bus 102 via bus connections 110 or other suitable interfaces. In this manner, one or more other components of system 100 can access security device 112 via signal bus 102.

[0021] As will be described in further detail below, the security device 112 can be any semiconductor or other SoC device designed to mitigate, for example, reverse engineering, circuit modification, and IP theft of the semiconductor device, or otherwise incorporate other security attributes, techniques, or features.

[0022] Other elements and functions not shown in FIG. 1 will become apparent from this disclosure, and it will be understood that other embodiments are not limited to any particular hardware configuration. For example, processor 104 may be any suitable processor and may include one or more coprocessors or controllers. In some examples, processor 104 may be implemented as any number of processor cores. Processor 104 (or processor core) may be any type of processor, such as, for example, a microprocessor, an embedded processor, a digital signal processor (DSP), a graphics processor (GPU), a network processor, a field programmable gate array (FPGA), or other device configured to execute program code. Processor 104 may include multi-threaded cores, as they may include more than one hardware thread context (or "logical processor") per core. Processor 104 may be implemented as a complex instruction set computer (CISC) or a reduced instruction set computer (RISC) processor. In some examples, processor 104 may include, for example, a microprocessor, an embedded processor, a digital signal processor (DSP), a graphics processor (GPU), a network processor, a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), or other device configured to execute program code. Processor 104 may be configured to execute an operating system (OS), such as Google Android (produced by Google Inc. of Mountain View, California), Microsoft Windows (produced by Microsoft Corp. of Redmond, Washington), Apple OS X (produced by Apple Inc. of Cupertino, California), Linux, or a real-time operating system (RTOS). As will be appreciated from this disclosure, the techniques provided herein may be implemented regardless of the specific operating system provided in conjunction with system 100, and thus may also be implemented using any suitable existing system or platform.

[0023] Memory 106 can be implemented using any suitable type of digital storage, including, for example, flash memory and / or random access memory (RAM). In some examples, memory 106 includes various layers of a standard memory hierarchy and / or a standard memory cache. Memory 106 can be implemented as a volatile memory device, such as, but not limited to, a RAM, dynamic RAM (DRAM), or static RAM (SRAM) device.

[0024] Network I / O 108 represents any suitable type of wired and / or wireless network interface designed to receive and transmit signals over a network. Wired communication can conform to existing standards, such as, for example, Ethernet. Wireless communication can conform to existing standards, such as, for example, cellular communication including LTE (Long Term Evolution), Wireless Fidelity (Wi-Fi), Bluetooth, and / or Near Field Communication (NFC). Examples of such wireless networks include, but are not limited to, wireless local area networks, wireless personal area networks, wireless metropolitan area networks, cellular networks, and satellite networks.

[0025] According to at least some examples, processor 104, memory 106, network I / O 108, security device 112, and any other device coupled to bus 102 can be designated as an unsecure source. An unsecure source or device can be any circuit or device that could be compromised in some way (e.g., through unauthorized use or inspection) and therefore cannot be fully trusted.

[0026] It should be understood that in some examples, some of the various components of system 100 may be combined or integrated into a SoC architecture. In some examples, the components may be hardware components, firmware components, software components, or any suitable combination of hardware, firmware, or software.

[0027] Unless expressly stated otherwise, it is understood that terms such as "processing," "computing," "calculating," and "determining" refer to the action and / or processing of a computer or computing system or similar electronic computing device that modulates and / or converts data represented as physical quantities (e.g., electronic) within the computer system's registers and / or memory units into other data similarly represented as physical entities within the computer system's registers, memory units, or other such information storage, transmission, or display. The embodiments are not limited in this context. Safety devices

[0028] FIG2 is a block diagram of the security device 112 of FIG1 according to an example of the present disclosure. The security device 112 can be implemented as, for example, an FPGA. The security device 112 includes a network-on-chip (NoC) module 200, a slave communication controller 202, a shared message random access memory 204, a processor 206, a direct memory access (DMA) controller 208, a communication interface 210, a data port 212, an electronic FPGA (eFPGA) configuration module 214, non-volatile RAM (NVRAM) 216, a clock 218, an on-chip oscillator 220, and the slave communication controller 202. The device 112 can include one or more programmable logic blocks 234 or test units, which can be used in conjunction with debug or boundary scan operations to test or otherwise exercise the operation of the device 112. Each programmable logic block 234 is accessible through the NoC module 200.

[0029] Slave communication controller 202 is operably coupled to slave communication interface 224, NoC module 200, and shared message RAM 204. Processor 206 is operably coupled to NoC module 200 and shared message RAM 204. DMA controller 208 is operably coupled to NoC module 200. Communication interface 210 is operably coupled to NoC module 200 and data port 212. In some examples, communication interface 210 includes a JTAG interface. eFPGA configuration module 214 is operably coupled to NoC module 200. NVRAM 216 is operably coupled to NoC module 200. Clock 218 is operably coupled to NoC module 200 and chip oscillator 220. Clock 218 is configured to receive a scan enable signal 228 and a reset signal 230. The host communication controller 222 is operatively coupled to the NoC module 200 and the host communication interface 226 .

[0030] NoC module 200 is configured to provide data and signal communication between various components of device 112, such as processor 206, communication interface 210 via data port 212, eFPGA configuration module 214, NVRAM 216, and clock 218. In this manner, NoC module 200 can provide access to various components of device 112 from data port 212 via communication interface 210. For example, a user can use data port 212 to read data from or write data to NVRAM 216; access debug functions of device 112; modify the FPGA configuration in eFPGA configuration module 214; and modify clock 218. However, as described above, when device 112 is under the control of an untrusted foundry or other entity, a user could potentially obtain information about the logic design of device 112 via data port 212 (e.g., using boundary scan functionality) or otherwise alter the device's functionality (e.g., by reclocking device 112, which could cause it to enter an unprotected state). To this end, device 112 includes various design aspects and components that can be used to prevent unauthorized use or inspection, such as described below. Secure communication interface

[0031] According to examples of the present disclosure, communication interface 210 (e.g., a JTAG interface) is configured to reject some or all commands received from data port 212 or slave communication interface 224 unless a valid access key 232 is present, depending on the security level of communication interface 210 (e.g., partially open or fully open). In some examples, processor 206 is configured to generate access key 232. Access key 232 can be any data, such as a series of numbers, characters, or values. For example, processor 206 can generate access key 232 based on the value set by an electronic fuse (or eFuse) configured to change circuitry on security device 112 during operation. In another example, processor 206 can generate access key 232 based on a random number generator external to security device 112 (e.g., another component of the system to which security device 112 is connected). Other techniques for generating access key 232 will be apparent in light of this disclosure, including hardware-, firmware-, and software-based techniques. Access key 232 can be static or variable, depending on the algorithm programmed into processor 206. In some examples, the access code includes a challenge code and a response code. These are sent from processor 206 to communication interface 210 (e.g., a JTAG controller) via dedicated signals. A user can enter a JTAG command through communication interface 210 to retrieve the challenge code. The user can then return a response code via another JTAG command. If the user-provided response code matches the response code from processor 206, communication interface 210 is unlocked, allowing further access. In some examples, the challenge code and response code are user-configurable.

[0032] Communication interface 210 is configured to enable communication access to NoC module 200 (and all other components of device 112) via data port 212 in response to the presence of a valid access key 232. Communication interface 210 is also configured to disable communication access to NoC module 200 via data port 212 in response to the absence of a valid access key 232 or the presence of an invalid access key. In some examples, communication interface 212 can have multiple modes, each providing a different level of access to device 112. In this manner, communication interface 210 is partially or completely disabled when access key 232 is absent and enabled when access key 232 is present. FPGA configuration control

[0033] According to examples of the present disclosure, the logic of device 112 (e.g., program code to be executed by device 112) is compiled so that device 112 cannot operate unless the correct operating configuration is loaded by eFPGA configuration module 214. In some examples, eFPGA configuration module 214 loads the configuration stored in NVRAM 216 or elsewhere within device 112 during boot-up or start time. In some examples, NVRAM 216 is isolated to a protected area of ​​device 112, such that NVRAM 216 cannot be accessed via data port 212 or slave communication interface 224 unless authorized by processor 206. Furthermore, NVRAM 216 can be configured to store executable instructions and data for use by processor 206, thereby protecting processor 206 from unauthorized external control. Boundary Scan and Clock Control

[0034] According to an example of the present disclosure, device 112 includes a programmable logic block 234 (or test cell) configured to operate in boundary scan mode (also referred to as scan mode). NVRAM 216 is configured to store field programmable gate array (FPGA) configuration data that can be loaded into eFPGA configuration module 214. Clock 218 is configured to enable scan mode for the programmable logic block and / or de-assert a reset signal to the programmable logic block in response to the presence of FPGA configuration data in eFPGA configuration module 214. Clock 218 is also configured to disable scan mode for the programmable logic block and / or assert a reset signal to the programmable logic block in response to the absence of FPGA configuration data in eFPGA configuration module 214. In some examples, clock 218 is controlled by a chip oscillator 220, which is configured to internally generate a clock signal for operating device 112.

[0035] In some examples, the device 112 is configured to disable the boundary scan function (e.g., ignore or bypass the scan enable signal 228 to prevent the scan string from being executed) and / or maintain the RESET signal 230 in a constant state to prevent the device 112 from being reset and operating (e.g., disabling the clock 212) when the eFPGA configuration module 214 does not load a configuration or loads an incorrect configuration.

[0036] In some examples, the slave communication controller 202 is configured to receive data access commands via the slave communication interface 224. For example, the command may include a request to access data stored in the NVRAM 216. In such an example, the command is passed to the processor 206 via the shared message RAM module 204. The processor 206 extracts the command from the shared message RAM module 204. The processor 206 is configured to determine whether the command is valid (e.g., it has access rights to the NVRAM 216) and, if so, send the data stored in the NVRAM 216 to the master communication controller 222 for output via the master communication interface 226. External command control

[0037] According to an example of the present disclosure, processor 206 is configured to receive one or more commands from shared message RAM 204. A command may include, for example, a request to output data from any portion of device 112 to master communication interface 226 via master communication controller 222. Commands may be loaded into shared message RAM 204 from slave communication interface 224 via slave communication controller 202. Processor 206 is also configured to determine whether execution of one or more commands is authorized. If processor 206 determines that one or more commands are authorized, the results of the commands (e.g., data) are output to master communication interface 226 via master communication controller 222. Otherwise, the commands are not executed. Safety device mode

[0038] FIG3 is a block diagram illustrating several modes of the security device 112 of FIG1 and FIG2 according to an example of the present disclosure. In a first mode 302 in which no access key is present, the communication interface 210 is at least partially disabled 304. In the first mode 302, for example, JTAG commands are prevented from executing within the device 112 due to the disabled communication interface 210, which helps protect the device 112 from unauthorized use and inspection via the data port 212.

[0039] In the second mode 306 in which no FPGA configuration is present in the eFPGA configuration module 214, one or more of the following may occur: the communication interface 210 is at least partially disabled 304; boundary scan operations are disabled 308; the reset (RESET) signal is held in a constant state (high or low) 310, and / or the program code programmed in the device 112 is rendered inoperable 312. In some examples, the clock 218 is configured to ignore or bypass the scan enable signal 228 to prevent the scan string from being executed (disabling boundary scan 308). In some other examples, the clock 218 is configured to hold the reset (RESET) signal in a constant state 310, rendering the processor 206 unable to execute commands (such as by disabling the processor 206 clock). In some other examples, the device 112 includes inoperable program code unless a suitable FPGA configuration is present to complement the program code programmed in the device 112. In this manner, the device 112 may be configured in the second mode 306 to execute only those functions for which the code was not compiled when the FPGA configuration existed.

[0040] In a third mode 314, the device 112 can be configured to operate 316 when the FPGA configuration is present. For example, in the third mode 314, the communication interface 210 is at least partially capable of sending and receiving commands and data via the data port 212; boundary scan is enabled; and / or the reset (RESET) signal is not held in a constant state 310, which allows the processor 206 to execute instructions. Other variations of these modes will be apparent in light of this disclosure. Process Flow

[0041] FIG4 is a flow chart of an exemplary process 400 for enabling and disabling the communication interface 210 of the device 112 of FIG2 , according to an example of the present disclosure. The process 400 includes receiving a command 402 via the communication interface 210 (e.g., data port 212). The process 400 also includes generating an access key 404 (e.g., via the processor 206 ). The access key can be, for example, a static or variable value. If a valid access key 406 is present, the process 400 includes enabling 410 the communication interface 210 so that the command can be passed to other components of the device 112 (e.g., the processor 206 ) for processing 412. If a valid access key 406 is not present, the process 400 includes at least partially or completely disabling 408 the communication interface 210. The access key can be any data, such as a series of numbers, characters, or values.

[0042] FIG5 is a flow chart of an exemplary process 500 for operating device 112 of FIG2 according to examples of the present disclosure. Process 500 includes powering on or starting up 502 the device and loading 504 the FPGA configuration into the memory of device 112 (e.g., loading the FPGA configuration from NVRAM 216 or from another memory into eFPGA configuration module 214). For example, the logic of device 112 (e.g., program code to be executed by device 112) is compiled so that device 112 cannot operate unless eFPGA configuration module 214 is loaded with the correct configuration for operation 506. In some examples, NVRAM 216 is isolated to a protected area of ​​device 112 so that NVRAM 216 cannot be accessed via data port 212 or slave communication interface 224 unless authorized by processor 206.

[0043] FIG6 is a flow chart of an exemplary process 600 for boundary scan and clock control of device 112 of FIG2 according to an example of the present disclosure. Process 600 includes detecting 602 an FPGA configuration loaded into eFPGA configuration module 214. If eFPGA configuration module 214 does not load a configuration 604, or loads an incorrect configuration, process 600 includes disabling 606 the boundary scan function and / or maintaining 608 the RESET signal in a constant state to prevent reset and operation of device 112 (e.g., disabling clock 212). Otherwise, process 600 includes enabling 610 the boundary scan function of device 112. Further exemplary embodiments

[0044] The following examples relate to further embodiments, from which various arrangements and configurations will become apparent.

[0045] Example 1 provides a secure semiconductor device including a data port; a network-on-chip (NoC) module; a processor communicatively coupled to the NoC module, the processor configured to generate an access key; and a communication interface operably coupled to the processor and the data port, the communication interface configured to enable communication access to and from the NoC module via the data port in response to the presence of the access key, and to disable communication access to and from the NoC module via the data port in response to the absence of the access key.

[0046] Example 2 includes the subject matter of Example 1, further comprising an electronic field programmable gate array (eFPGA) configuration module; and a clock configured to assert a reset (RESET) signal in response to the absence of FPGA configuration data stored in the eFPGA configuration module, thereby disabling operation of the device.

[0047] Example 3 includes the subject matter of either Example 1 or 2, further comprising an electronic field programmable gate array (eFPGA) configuration module; a programmable logic block configured to operate in a boundary scan mode; and a clock configured to disable the boundary scan mode of the programmable logic block in response to the absence of FPGA configuration data stored in the eFPGA configuration module.

[0048] Example 4 includes the subject matter of any one of Examples 1 to 3, further comprising a programmable logic block configured to operate in a boundary scan mode; an electronic field programmable gate array (eFPGA) configuration module; non-volatile random access memory (NVRAM) configured to store field programmable gate array (FPGA) configuration data; and a clock configured to enable the boundary scan mode of the programmable logic block and / or deactivate a reset signal to the programmable logic block in response to the presence of the FPGA configuration data in the eFPGA configuration module, and to disable the boundary scan mode of the programmable logic block and / or assert the reset signal to the programmable logic block in response to the absence of the FPGA configuration data in the eFPGA configuration module.

[0049] Example 5 includes the subject matter of any one of Examples 1-4, wherein the communication interface comprises a JTAG interface.

[0050] Example 6 includes the subject matter of any of Examples 1-5, further comprising a wafer oscillator operably coupled to the processor.

[0051] Example 7 provides a secure semiconductor device comprising a Network on Chip (NoC) module; an electronic field programmable gate array (eFPGA) configuration module; and a clock operably coupled to the eFPGA configuration module via the NoC module, the clock being configured to assert a reset (RESET) signal in response to the absence of FPGA configuration data stored in the eFPGA configuration module, thereby disabling operation of the device.

[0052] Example 8 includes the subject matter of Example 7, further comprising a data port; a processor communicatively coupled to the NoC module, the processor configured to generate an access key; and a communication interface operably coupled to the processor and the data port, the communication interface configured to enable communication access to and from the NoC module via the data port in response to the presence of the access key, and to disable communication access to and from the NoC module via the data port in response to the absence of the access key.

[0053] Example 9 includes the subject matter of any of Examples 7 and 8, wherein the communication interface comprises a JTAG interface.

[0054] Example 10 includes the subject matter of any of Examples 7 to 9, further comprising a programmable logic block configured to operate in a boundary scan mode, wherein the clock is configured to disable the boundary scan mode of the programmable logic block in response to the absence of FPGA configuration data stored in the eFPGA configuration module.

[0055] Example 11 includes the subject matter of any one of Examples 7 to 10, further comprising a programmable logic block configured to operate in a boundary scan mode; and a non-volatile random access memory (NVRAM) configured to store field programmable gate array (FPGA) configuration data, wherein the clock is configured to enable the boundary scan mode of the programmable logic block and / or disable a reset signal to the programmable logic block in response to the presence of the FPGA configuration data in the eFPGA configuration module, and to disable the boundary scan mode of the programmable logic block and / or enable the reset signal to the programmable logic block in response to the absence of the FPGA configuration data in the eFPGA configuration module.

[0056] Example 12 includes the subject matter of any of Examples 7-11, further comprising a wafer oscillator operably coupled to the clock.

[0057] Example 13 provides a security system comprising a data port; a network-on-chip (NoC) module; a processor communicatively coupled to the NoC module; a communication interface operably coupled to the processor and the data port; an electronic field programmable gate array (eFPGA) configuration module operably coupled to the NoC module; and a clock operably coupled to the NoC module, wherein in a first mode, the communication interface is at least partially disabled, wherein in a second mode, the communication interface is at least partially disabled, boundary scan operations are disabled, a reset (RESET) signal is held in a constant state, and / or programmed code is rendered inoperable, and wherein in a third mode, the communication interface is at least partially enabled to send and receive commands and data via the data port, the boundary scan operations are enabled, the reset (RESET) signal is not held in the constant state, and / or the programmed code is operable.

[0058] Example 14 includes the subject matter of Example 13, further comprising a wafer oscillator operably coupled to the clock.

[0059] Example 15 includes the subject matter of any of Examples 13 and 14, wherein the communication interface comprises a JTAG interface.

[0060] Example 16 includes the subject matter of any one of Examples 13 to 15, wherein in the first mode or the second mode, the communication interface is configured to enable communication access to and from the NoC module via the data port in response to the presence of the access key, and to disable the communication access to and from the NoC module via the data port in response to the absence of the access key.

[0061] Example 17 includes the subject matter of any of Examples 13 to 16, wherein in the second mode, the clock is configured to assert a reset (RESET) signal in response to the absence of FPGA configuration data stored in the eFPGA configuration module.

[0062] Example 18 includes the subject matter of any of Examples 13 to 17, wherein in the second mode, the clock is configured to disable the boundary scan mode of the programmable logic block in response to the absence of FPGA configuration data stored in the eFPGA configuration module.

[0063] Example 19 includes the subject matter of any of Examples 13 to 18, further comprising a programmable logic block configured to operate in a boundary scan mode; and non-volatile random access memory (NVRAM) configured to store field programmable gate array (FPGA) configuration data, wherein, in the second mode, the clock is configured to disable the boundary scan mode of the programmable logic block and / or assert a reset signal to the programmable logic block in response to the FPGA configuration data not being present in the eFPGA configuration module.

[0064] Example 20 includes the subject matter of any one of Examples 13 to 19, further including wherein, in the second mode, the clock is further configured to enable the boundary scan mode of the programmable logic block and / or disable the reset signal to the programmable logic block in response to the presence of the FPGA configuration data in the eFPGA configuration module.

[0065] The terms and expressions employed herein are used as terms of description and not of limitation, and it is not intended that any equivalents of the features shown and described (or portions thereof) be excluded by the use of such terms and expressions, and it is recognized that various modifications may be made within the scope of the claims. Accordingly, the claims are intended to cover all such equivalents. Various features, aspects, and embodiments have been described herein. As will be understood from this disclosure, these features, aspects, and embodiments are susceptible to mutual combination, as well as variations and modifications. Accordingly, the disclosure should be construed as including such combinations, variations, and modifications. It is intended that the scope of the disclosure be limited not by this detailed description, but rather by the appended claims. Future applications claiming priority from the present application may variously claim the subject matter of the disclosed claims and may generally include any combination of one or more elements as variously disclosed or otherwise illustrated herein.

[0066] 100: Security System 102: Signal bus 104: Processor 106: Memory 108: Network I / O circuit 110: Bus connection 112: Safety device 200: Network on Chip (NoC) module 202: Slave communication controller 204: Shared Message Random Access Memory 206: Processor 208: Direct Memory Access (DMA) Controller 210: Communication interface 212: Data Port 214: Electronic FPGA (eFPGA) Configuration Module 216: Non-volatile RAM (NVRAM) 218:Clock 220:Chip Oscillator 222: Main communication controller 224: Slave Communication Interface 226: Main Communication Interface 228: Scan enable signal 230: Reset (RESET) signal 232: Access Key 234: Programmable Logic Block 302: First Mode 304: Communication interface 210 is at least partially disabled 306: Second Mode 308: Boundary scan operation is disabled 310: Keep the reset (RESET) signal in a constant state 312: Render the edited code in device 112 inoperable 314: Third Mode 316: The device 112 may be configured to operate 400: Process 402~412: Steps 500: Process 502~506: Steps 600: Process 602~610: Steps

Claims

1. A safety semiconductor device, comprising: Network on chip (NoC) module; Electronic Field-Programmable Gate Array (eFPGA) configuration module; And a clock operatively coupled to the eFPGA configuration module via the NoC module, the clock being configured to assert a reset signal in response to the absence of FPGA configuration data stored in the eFPGA configuration module, thereby disabling the operation of the device.

2. The apparatus of claim 1 further includes: Data port; A processor is communicatively coupled to the NoC module, and the processor is configured to generate access keys; And a communication interface operatively coupled to the processor and the data port, the communication interface being configured to enable communication access to and from the NoC module via the data port in response to the presence of the access key, and to disable the communication access to and from the NoC module via the data port in response to the absence of the access key.

3. The apparatus of claim 2, wherein the communication interface includes a JTAG interface.

4. The apparatus of claim 1 further includes: A programmable logic block is configured to operate in a boundary scan mode, wherein the clock is configured to disable the boundary scan mode of the programmable logic block in response to the absence of FPGA configuration data stored in the eFPGA configuration module.

5. The apparatus of claim 1 further includes: The programmable logic block is configured to operate in boundary scan mode; And non-volatile random access memory (NVRAM) is configured to store field-programmable gate array (FPGA) configuration data, wherein the clock is configured to enable the boundary scan mode of the programmable logic block and / or disable the reset signal of the programmable logic block in response to the presence of the FPGA configuration data in the eFPGA configuration module, and to disable the boundary scan mode of the programmable logic block and / or enable the reset signal of the programmable logic block in response to the absence of the FPGA configuration data in the eFPGA configuration module.

6. The apparatus of claim 1 further includes a chip oscillator operatively coupled to the clock.

7. A security system, comprising: Data port; Network on chip (NoC) module; The processor is communicatively coupled to the NoC module; A communication interface operatively coupled to the processor and the data port; An electronic field-programmable gate array (eFPGA) configuration module operably coupled to the NoC module; and a clock operably coupled to the NoC module, wherein in a first mode, the communication interface is at least partially disabled; wherein in a second mode, the communication interface is at least partially disabled, boundary scan operations are disabled, a reset signal is held in a constant state, and / or the redacted code is rendered inoperable; and wherein in a third mode, the communication interface is at least partially enabled to send and receive commands and data via the data port, the boundary scan operations are enabled, the reset signal is not held in the constant state, and / or the redacted code is operable.

8. The system of claim 7 further includes a chip oscillator operatively coupled to the clock.

9. The system as requested in item 7, wherein the communication interface includes a JTAG interface.

10. The system of claim 7, wherein in the first mode or the second mode, the communication interface is configured to enable communication access to and from the NoC module via the data port in response to the presence of the access key, and to disable the communication access to and from the NoC module via the data port in response to the absence of the access key.

11. The system of claim 7, wherein in the second mode, the clock is configured to assert the reset signal in response to the absence of FPGA configuration data stored in the eFPGA configuration module.

12. The system of claim 7, wherein in the second mode, the clock is configured to disable the boundary scan operations in response to the absence of FPGA configuration data stored in the eFPGA configuration module.

13. The system as described in request item 7 also includes: The programmable logic block is configured to operate in boundary scan mode; And non-volatile random access memory (NVRAM) is configured to store field-programmable gate array (FPGA) configuration data, wherein, in the second mode, the clock is configured to disable the boundary scan mode of the programmable logic block and / or enable the reset signal of the programmable logic block in response to the absence of the FPGA configuration data in the eFPGA configuration module.

14. The system as described in request item 13 also includes: in, In this second mode, the clock is also configured to enable the boundary scan mode of the programmable logic block and / or disable the reset signal of the programmable logic block in response to the presence of the FPGA configuration data in the eFPGA configuration module.

Images