Protection of fuse-type memory contents

Abstract

Embodiments of the present disclosure relate to protection of fuse-type memory content. The present disclosure relates to a method in which the state of an integrated circuit between a first state (e.g., closed) in which a processor is permitted read access to a first region of a fuse-type non-volatile memory and a second state (e.g., open) in which the processor is prohibited read access to the memory is regulated by a finite state machine to a verification of a value of a first fuse word of the memory, the first fuse word representing a number of transitions to the first state, and a value of a second fuse word of the memory, the second fuse word representing a number of transitions to the second state.

Description

[0001] Cross-references to related applications

[0002] This application claims priority to French patent application No. 21 / 02717, filed on March 18, 2021, which is incorporated herein by reference in its entirety. Technical Field

[0003] This disclosure generally relates to electronic circuits, and in certain embodiments to an integrated circuit having a fuse-type nonvolatile memory and to testing the integrated circuit. Background Technology

[0004] Integrated circuits are used in the design of electronic devices with a wide range of applications. Both during production and throughout the product's lifespan, integrated circuits are tested for manufacturing defects. Typically, testing requires access to the integrated circuit and uses a standardized protocol called the Joint Test Action Group (JTAG) via the circuit's dedicated ports.

[0005] The JTAG interface is currently used for testing memory, particularly non-volatile memory. It can be used throughout production and product lifespan, especially during maintenance operations, to identify potential manufacturing defects. The integrated circuit is then typically returned to the manufacturer.

[0006] Specifically, a customer may want to return a product to the manufacturer for retesting for manufacturing defects. The customer is not running these tests as part of routine maintenance. The customer notices a problem, suspects it might be a manufacturing defect, and returns the product so the manufacturer can rerun the scanning tests to analyze the defect.

[0007] Testing processes and access to information contained in the memory of integrated circuits can cause problems in applications where this memory contains information assumed to be hidden from the manufacturer. This could involve authentication or cryptographic keys (more generally, passwords, codes, or keys used throughout the circuit's lifespan), software code, or proprietary protocols stored in the circuit during a customization phase performed by the circuit's end user or by an intermediary entity between the manufacturer and that user. These elements constitute information hidden from the manufacturer (secrets), which should generally not be communicated to the integrated circuit manufacturer.

[0008] When the non-volatile memory of a circuit is an erasable or reprogrammable type (flash memory or EPROM), the memory area containing the "secret" information can be erased before returning to the circuit for defect analysis. However, when the non-volatile memory is a fuse type, its programming is irreversible, so leaving access to the circuit via its JTAG interface during testing to perform operations on the circuit component is problematic. Summary of the Invention

[0009] There is a need to improve the security and efficiency of methods for testing devices having integrated circuits containing irreversible programmable nonvolatile memory. Embodiments of this disclosure overcome all or some of the disadvantages of known devices having integrated circuits.

[0010] One embodiment provides a method in which the state of an integrated circuit is regulated between a first state that allows read access to a first region of a fuse-type nonvolatile memory by a processor and a second state that prohibits read access to the memory by a processor, by verifying the values ​​of a first fuse word representing the number of transitions from a memory representation to a first state and a second fuse word representing the number of transitions from a memory representation to a second state via a finite state machine.

[0011] One embodiment provides an integrated circuit including a finite state machine that adjusts the state of the integrated circuit between a first state and a second state to verify the values ​​of a first fuse word (representing the number of transitions to the first state) and a second fuse word (representing the number of transitions to the second state) of the memory. The first state allows read access by a processor to a first region of the fuse-type nonvolatile memory, and the second state prohibits read access by the processor to the memory.

[0012] According to one embodiment, verification consists of comparing the corresponding values ​​of the first and second words and checking the value of the most significant bit of the first word.

[0013] According to one embodiment, the circuit is in a first state if the value of the second word is lower than the value of the first word, or if the most significant bit of the first word is blown out.

[0014] According to the embodiment, verification is performed each time the integrated circuit is reset.

[0015] According to an embodiment, in the first state, scanning tests of the integrated circuit are prohibited.

[0016] According to an embodiment, in the second state, scan testing is enabled for integrated circuits other than fuse-type non-volatile memory.

[0017] According to one embodiment: a first counter defined by a first word of memory is incremented before each transition of the integrated circuit to the first state; a second counter defined by a second word of memory is incremented before each transition of the integrated circuit to the second state.

[0018] According to one embodiment, the increment of the second counter is specifically caused by a state machine.

[0019] According to one embodiment, the processor can access the increment of the first counter.

[0020] According to one embodiment, the transition of the circuit from a first state to a second state is performed only if the value emerging from the reset corresponds to code stored in a first region of a fuse-type non-volatile memory, the value entering the register from outside the circuit when the circuit is in reset, and the code being readable only by a finite state machine.

[0021] According to one embodiment, when the integrated circuit is in a first state after being unloaded from a reset, the introduction of any value in the register increments a third counter defined by a third word of the memory, provided that the maximum valid bit of the third word is not 1.

[0022] According to one embodiment, after being released from reset, if the value of the third counter is greater than the value of the second counter, the most valid fuse bit of the first fuse word is in a programmed state, or the most valid fuse bit of the third fuse word is in a programmed state, then the circuit is in the second state.

[0023] According to one embodiment, if the value of the first counter is less than or equal to the value of the second counter, and the most significant bit of the third and first fuse words is in a non-programmed state, the circuit is in a first state. Attached Figure Description

[0024] To gain a more complete understanding of this disclosure and its advantages, reference is now made to the following description in conjunction with the accompanying drawings, wherein:

[0025] Figure 1 This is a schematic diagram of an embodiment of an integrated circuit device;

[0026] Figure 2 This is a schematic diagram of an embodiment of an integrated circuit;

[0027] Figure 3 This is a flowchart of an embodiment method for protecting the contents of a fuse-type memory; and

[0028] Figure 4 This is a flowchart of an embodiment of a method for transitioning to a scan test availability mode for integrated circuits. Detailed Implementation

[0029] This disclosure provides numerous applicable inventive concepts that can be implemented in a wide variety of specific contexts. Specific embodiments are merely illustrative of particular configurations and do not limit the scope of the claimed embodiments. Unless otherwise stated, features from different embodiments can be combined to form other embodiments.

[0030] The variations or modifications described in one embodiment may also be applied to other embodiments. Furthermore, it should be understood that various changes, substitutions, and alterations may be made without departing from the spirit and scope of this disclosure as defined by the appended claims.

[0031] In the various figures, the same features are indicated by the same reference numerals. In particular, common structural or functional features in the various embodiments may have the same reference numerals and may have the same structure, dimensions, and material properties.

[0032] For clarity, only the steps and elements useful for understanding the embodiments described herein are shown and described in detail.

[0033] Unless otherwise stated, when referring to two elements connected together, it means that there is no direct connection between them except for the conductor, and when referring to two elements coupled together, it means that the two elements can be connected or they can be coupled through one or more other elements.

[0034] In the following disclosure, unless otherwise stated, when referring to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or when referring to relative position qualifiers, such as the terms "above", "below", "upper", "lower", etc., or when referring to orientation qualifiers, such as "horizontal", "vertical", etc., the orientation shown in the figure is used.

[0035] Unless otherwise stated, the terms “about,” “approximately,” “basically,” and “in the order of…” indicate within 10%, preferably within 5%.

[0036] Figure 1 An embodiment of an electronic device 100 including an integrated circuit 102 is schematically shown in block form, the embodiment being applied to an integrated circuit 102 of this type as an example.

[0037] Electronic devices include, for example, electronic boards such as microcircuit cards, computer hardware, and microprocessor circuits.

[0038] In the application addressed by this disclosure, integrated circuit 102 includes fuse-type non-rewritable non-volatile memory (FUSE NV MEM) 110. By default, at the manufacturing output, all fuse-type bits of memory 110 are in the same state, arbitrarily 0. Depending on the native state of the fuse bit, this state corresponds to the non-conducting or "off" state of the storage element defining the bit. During the customization of electronic device 100, before it is acquired by the end user, data is stored in non-volatile memory 110 by switching the state of certain bits of the memory (memory word) to the opposite state 1 (by fusing), for example, corresponding to the conducting or "on" state of the corresponding storage element.

[0039] The designation of the corresponding on and off states of memory bits as "0" or "1" is arbitrary, and an alternative convention may be adopted depending on the application, for example, the opposite: 0 for on and 1 for off.

[0040] Of the data stored in memory 110, some is not particularly sensitive in terms of confidentiality, while others are considered confidential data that cannot be removed from the circuit once introduced into it. Integrated circuit 102 also includes a processor (CPU) 112, which can access memory 110 via a wrapper 106. Integrated circuit 102 also includes a JTAG (Joint Test Action Group) access port 104, which allows a user to connect a JTAG-type interface (not shown) to the circuit to request the execution of system tests. These tests are, for example, circuit continuity tests to detect possible short circuits or tests of circuit logic function. Scan tests can be performed during prototype design, during manufacturing, or when device 100 is returned to the manufacturer for defect analysis.

[0041] However, "secret" (i.e., confidential data) should not be accessible via the test interface. Therefore, at the (final) step of manufacturing or customizing the circuit, the circuit is "closed" before the secret information from the manufacturer is introduced into the circuit, corresponding to a state where scanning tests cannot be performed.

[0042] However, once the circuit is in use, it is forbidden to test it or for the manufacturer to analyze defects that may originate from manufacturing.

[0043] The described embodiments provide a novel mechanism for authorizing access to integrated circuits during testing without adversely affecting data security.

[0044] To this end, the possibility of an "OPEN" circuit is provided, which allows JTAG access port 104 to initiate a scan test while protecting access to "secret" data.

[0045] Therefore, particularly from the viewpoint of JTAG port 104, circuitry with a "closed" state is provided, in which scan tests are blocked. Furthermore, wrapper 106 allows processor 112 to access memory 110, including its protected portion (202, ...). Figure 2 The protected portion contains both "secret" and "open" states that allow for scan testing. Furthermore, the package 106 prohibits any access to the protected portion 202 of the memory 110 via the processor 112 or even via scan.

[0046] To this end, the described embodiment provides the presence of a finite state machine (FSM) 108 to control the transition from the “closed” state to the “open” state of the circuit. Furthermore, a wrapper 106 included in the circuit 102 ensures compatibility between data input via the JTAG interface and data stored in the non-rewritable non-volatile memory 110. The wrapper 106 contains the finite state machine 108 and is coupled to an access port 104 and the non-volatile memory 110. In this embodiment, the JTAG access port 104 cannot be coupled to the processor 112, and specifically, the corresponding operations of the processor 112 and the finite state machine 108 are independent of each other.

[0047] Figure 2 By Figure 1 A more detailed block diagram schematically illustrates an embodiment of an integrated circuit type to which the described embodiment is applied, as an example.

[0048] According to the embodiment, a fuse-type non-volatile memory 110 is provided to include or be divided into multiple different memory regions.

[0049] The first area (protected) 202, containing protected data, contains all data (program or physical data) that, when the circuit is closed, should be accessed as if operating in a secure mode or environment. The data is stored by the circuit's end user or by an intermediary entity between the manufacturer and that user. This data may be authentication or keys, software code, or proprietary protocols, etc. Within the data, codes or passwords are contained in dedicated memory words 204. This or these codes are specifically used to regulate the resealing of the circuit.

[0050] Code 204 can only be read by wrapper 106, and more specifically, only by state machine 108. Code 204 may be stored in region 202 by the manufacturer during the production of circuit 102, but is preferably selected and stored during the customization phase. Code 204 corresponds to a fuse-type secret code that, once programmed (or locked), can only be accessed by the finite state machine 108.

[0051] At each boot of the circuit, state machine 108 determines whether the chip is in an "open" or "closed" state. If the chip is in a "closed" state, and if the contents have entered register 206 of wrapper 106 before the chip is unpacked from reset, the finite state machine compares code 204 with the contents. During chip reset, JTAG port 104 is active, and contents can be input and then stored in register 206.

[0052] Register 206, accessible via JTAG port 104, is typically a shift register (volatile shift) that is written to via the JTAG section and read from state machine 108. Writing to the register is usually performed via data input TDI by ordering signals TCK originating from the JTAG interface. Function 109, which compares data input via port 104 with data contained in code 204, also forms part of the finite state machine.

[0053] The circuit is opened via the JTAG interface to input data corresponding to code 204 stored during customization, while the circuit is closed to retain data that the user does not want the manufacturer to access. Code 204 can only be read and processed by finite state machine 108, and not by processor 112.

[0054] In practice, testing via the JTAG interface is rarely needed during the product's lifespan (after customization). Most often, it happens only once or twice (at most about ten times) along the product's life. This limited need is used to limit the number of possible attempts to open the circuitry. Limiting the number of possible attempts to open the circuitry avoids the risk of hacking through multiple code attempts via the JTAG interface.

[0055] To this end, a second region containing memory words 208 (WORD1), 210 (WORD2), and 212 (WORD3) is provided in memory 110, which have specific functions for opening and closing circuits. More specifically, when the chip is in a reset state, each word 208, 210, and 212 forms a counter for the number of closed circuits, the number of open circuits, and the number of data inputs via port 104, respectively. Initially, all fuse type bits of words 208, 210, and 212 are in the same state, arbitrarily set to 0. Word 210 can only be blown by a finite state machine (not cell 112).

[0056] The lengths of words 208, 210, and 212 can be the same or different between words. This length adjusts the number of closure, open, and password input attempts via the JTAG interface, depending on the word. Preferably, each word 208, 210, and 212 comprises at least 8 bits, preferably 32 bits. Because the bits of words 208 to 212 are irreversibly programmable, the corresponding counters do not count numbers that can reach powers of 2 in terms of the number of bits, but rather count numbers that can reach at most a certain number of bits.

[0057] For simplicity, reference will be made below to one bit of each operation-fuse-fuse word 208, 210, 212. However, it should be noted that in practice, for reliability reasons, it is preferable to fuse the bits in each group (e.g., four bits) of the same word at each programming location. This allows for reliable consideration of the counts provided by the corresponding counters. In read mode, it is considered sufficient for a single bit of the group to be in state 1 to account for changes in value. Thus, for a 32-bit word, the corresponding counter can take eight values.

[0058] Each time during the boot process of the closed circuit, if data has been stored in register 206 before the chip is unloaded from reset, finite state machine 108 fuses the bit (or bit group) of the counter shown by word 212. This utilizes one of the password guessing opportunities. Once all bits of word 212 are in state 1, circuit 102 is clamped in the "closed" state. For example, in the case where word 212 is formed of 8 bits (or 32 bits programmed in groups of 4 bits), the circuit is clamped after 8 attempts to input the password via the JTAG interface.

[0059] If the input data in the interface corresponds to (e.g., the same or a logical combination linked by function 109) code 204, this means that the entity owning the circuit has the correct password to "unseal" the circuit. If the chip is not clamped to the "closed" state, the finite state machine 108 then fuses the bit of word 210, thereby "re-unsealing" the chip. This "useup" is one of the available circuit-unsealing opportunities.

[0060] The circuitry, excluding the fuse-type non-volatile memory 110, can then be scanned and tested. The "unsealed" chip can be "sealed" at any time by blowing a bit (or bit group) of the counter indicated by word 208. This operation can be performed by the processor 112 or a debugger attached to JTAG port 104.

[0061] The closure of the circuit involves one bit of the fuse word 208, thus consuming one of the opportunities for the circuit to be closed. If all bits of word 208 are blown, the circuit is clamped to the closed state and can no longer be reopened.

[0062] In a simplified embodiment, only counters 208 and 210 are provided. In practice, counter 212 only prevents very difficult brute-force password guessing attacks. This is useful if the password 204 is short.

[0063] While this is not directly related to the protection of the contents of memory 110 during test execution, the advantage of the implementation being resealed by state machine 108 rather than processor 112 is that the resealing for scan testing will be effective even if there are manufacturing defects in processor 112 itself. Now, processor 112 occupies a considerable surface area of ​​circuitry 102, particularly compared to the majority of state machine 108, and the probability of defects within it causing circuit failure is not negligible.

[0064] Figure 3 This is a decision tree illustrating the implementation mode of a method for protecting the contents of a fuse-type memory.

[0065] More specifically, Figure 3 It is a decision tree representing the states experienced by circuit 102 in the open and closed states, respectively.

[0066] When the circuit 102 completes its boot or reset (block 301, reset), the finite state machine 108 verifies the state (open or closed) of the circuit 102. The state is determined by the corresponding values ​​of the first word 212, the second word 210, and the third word 208.

[0067] Preferably, verification of the corresponding counts represented by words 208, 210, and 212 is performed by determining the level of the most significant bit in state 1. Figure 3 In the example, it is assumed that all counters are on the same number of bits.

[0068] Therefore, in the example shown, finite state machine 108 begins by verifying (box 303, WORD1>WORD2?) whether the value of the first word 208 is greater than the value of the second word 210. If yes (output Y of box 303), this means that the last operation on words 208, 210, and 212 is the closure of circuit 102, and the state of circuit 102 is thus maintained in the closed state (box 309, Closed). If no (output N of box 303), in other words, if the value of the first word 208 is less than or equal to the value of the second word 210, then finite state machine 108 verifies (box 305, WORD1[MSB]=1?) whether the most significant bit (MSB) of the first word 210 is in state 1. If yes (output Y of box 305), the maximum number of circuit closures has been reached, and circuit 102 is in the closed state (box 309, Closed). Otherwise (output N of box 305), finite state machine 108 optionally verifies (box 306, WORD3[MSB] = 1?) whether the most significant bit (MSB) of the third word 212 is in state 1. If yes (output Y of box 307), this means that the maximum number of attempts to introduce the cipher has been reached, and the circuit then remains in closed state 309. Otherwise (output N of box 307), or step 305, if step 307 is omitted, the state of circuit 102 is open state (box 311, open), and the test interface can send the instructions required to perform a scan test on the circuit via a shift register.

[0069] In other words, in order for circuit 102 to be in the open state 311, the most significant bits of words 208 and 212 should have a value of 0, and the value of the second word 210 should be less than or equal to the value of the first word 208.

[0070] Figure 3 The order of steps 303, 305, and 307 is not important. In fact, these steps can be executed by state machine 108 in parallel or independently, because a single step is sufficient to provide a real result for the circuit in the closed state.

[0071] Figure 4 This is a flowchart illustrating the steps involved in transitioning an integrated circuit to test mode.

[0072] More specifically, Figure 4 This shows the state from closed 309 ( Figure 3 The flowchart shows the operation of the transition from reset 301 to reset mode.

[0073] When circuit 102 is in reset state, if the finite state machine is in the state of being reset... Figure 3When the verification is complete, the indicator circuit is in a closed state (box 309, closed), then finite state machine 108 performs the verification (box 403, PSW IN JTAG and WORD1[MSB] / = 1 and WORD3[MSB] / = 1). The contents of register 206 are used to verify whether the password has been entered via the JTAG interface at reset, and to verify the values ​​of the first and second words to check that none of them has their most significant bit in state 1 (i.e., fuse broken).

[0074] If no password is entered (output N of box 403), the test request verification process stops (box 411, proceed to 301), and once reset in box 301, the circuit remains closed.

[0075] If a password has already been entered (output Y in box 403), then in embodiments where the third word 212 exists, the finite state machine 108 fuses the state of the least significant bit of word 212 in state 0 to state 1. This action increments (box 405, WORD3 = WORD3 + 1) the counter for the number of attempts.

[0076] After step 403, and when step 405 applies, the internal data 204 is read by the wrapper 106. In step 407, the wrapper 106 verifies the correspondence (e.g., equality) between the data present in register 206 (box 405, PSW ON JTAG = PSW IN 204) and code 204.

[0077] If the data in register 206 does not match that in code 204 (output N in box 407), the verification process stops (box 411), and preferably by implementing... Figure 3 The circuit will remain closed during these steps.

[0078] If the data in register 206 matches that in code 204 (output Y in block 407), finite state machine 108 will switch the bit-fuse of the second word 210 in the lowest order of state 0 (block 409, WORD2 = WORD2 + 1) to state 1 to unseal the circuit. Then, the verification process ends (block 411), and the unsealed circuit is found at the next reset 301.

[0079] Initially (at the manufacturing output), all bits of the fuse memory 110 (at least the bits in region 202 and the bits in words 208, 210, and 212) are preferably in state 0. Therefore, the circuit is in an open state, and since no "secret" is introduced into region 202, this state is undisturbed.

[0080] The security of the data stored in zone 202 is related to the security of the transition from open mode to closed mode. This transition can be triggered by processor 112.

[0081] Preferably, the initial transition is triggered before the data to be protected is customized, and code 204 is already stored in region 202. For example, program code executed by processor 112 causes the least significant bit (LSB) of word 208 (WORD1) to fuse, which will put the circuit in a closed state on the next restart.

[0082] According to an alternative embodiment, a debugger attached to the circuit can fuse the bits of the lowest-order word 208, which is still in state 0, to shut down the chip.

[0083] According to an alternative embodiment, the first switch to the closed state can fuse all bits of word 208 at once (e.g., setting WORD1 = 7). To reopen the chip, the password will subsequently need to be entered several times (e.g., 7 times), and the transition to the open state will only succeed on the last (e.g., the 7th) entry (when the value of word 210 reaches 7). Thus, the transition from closed to open can only occur once.

[0084] According to another alternative embodiment, the check performed on the most significant bit of word 208 (maximum number of closed bits reached) can be replaced by the check performed on the most significant bit of word 210 (maximum number of open bits reached).

[0085] The advantage of this embodiment is that only the finite state machine 108 can read code 204. The central processing unit 104 cannot. Therefore, the surface area for attacks that extract 204 is reduced. In other words, resealing can only be performed by the finite state machine 108 and does not involve the central processing unit. Therefore, the surface area for fraud attacks on resealed chips is reduced.

[0086] Another advantage of the described embodiments is that the repackaging is performed by a processor-independent finite state machine, thereby enabling the detection of one or more defects that may exist in the processor.

[0087] Another advantage of the embodiment is that the implementation of the finite state machine requires simple combinatorial logic that can be implemented robustly.

[0088] Various embodiments and variations have been described. Those skilled in the art will understand that certain features of these various embodiments and variations can be combined, and other variations will occur to those skilled in the art.

[0089] Finally, based on the functional indications given above, the actual implementation of the described embodiments and variations is within the capabilities of those skilled in the art. In particular, the size of code 204 and words 208, 210, and 212 can vary from one embodiment to another.

[0090] Although this specification has been described in detail, it should be understood that various changes, substitutions, and alterations can be made without departing from the spirit and scope of this disclosure as defined by the appended claims. In the various drawings, the same elements are designated by the same reference numerals. Furthermore, the scope of this disclosure is not intended to be limited to the specific embodiments described herein, as it will be readily understood by one of ordinary skill in the art from this disclosure that existing or future processes, machines, manufactures, compositions of matter, means, methods, or steps may perform substantially the same functions or achieve substantially the same results as the corresponding embodiments described herein. Therefore, the appended claims are intended to include such processes, machines, manufactures, compositions of matter, means, methods, or steps within their scope.

[0091] Therefore, the specification and drawings are to be considered merely as a description of this disclosure as defined by the appended claims, and are to be considered to cover any and all modifications, variations, combinations or equivalents falling within the scope of this disclosure.

Claims

1. A method of operating an integrated circuit, comprising: verifying, by a finite state machine, a value of a first fuse word and a value of a second fuse word in a fuse-type non-volatile memory of the integrated circuit, the first fuse word representing a number of transitions to a first state of the integrated circuit, the second fuse word representing a number of transitions to a second state of the integrated circuit; based on the verification of the value of the first fuse word and the value of the second fuse word, allowing read access to a first region of the fuse-type non-volatile memory by a processor in the first state; and based on the verification of the value of the first fuse word and the value of the second fuse word, disallowing read access to the fuse-type non-volatile memory by the processor of the integrated circuit in the second state.

2. The method of claim 1, wherein the verifying comprises comparing the value of the first fuse word to the value of the second fuse word, and the verification is based on a value of a most significant bit of the first fuse word.

3. The method of claim 2, wherein the first state corresponds to a state of the integrated circuit in which: the value of the second fuse word is less than the value of the first fuse word, or a most significant bit of the first fuse word is blown.

4. The method of claim 1, wherein the verifying is performed at each reset of the integrated circuit, and wherein scan testing of the integrated circuit is disallowed in the first state.

5. The method of claim 1, wherein scan testing is enabled for the integrated circuit except for the fuse-type non-volatile memory in the second state.

6. The method of claim 1, wherein a transition from the first state to the second state is performed only in response to a value from a reset exit corresponding to code stored in the first region of the fuse-type non-volatile memory, the value entered into a register from outside the integrated circuit while the integrated circuit is in reset, the code only readable by the finite state machine.

7. The method of claim 6, wherein each transition of the integrated circuit to the first state is preceded by an increment of a first counter defined by the first fuse word, and wherein each transition of the integrated circuit to the second state is preceded by an increment of a second counter defined by the second fuse word.

8. The method of claim 7, wherein the increment of the second counter is caused only by the finite state machine, and wherein the increment of the first counter is accessible by the processor.

9. The method of claim 7, wherein when the integrated circuit is in the first state upon exit from reset, a value is introduced in a register such that a third counter defined by a third fuse word in the fuse-type non-volatile memory is incremented, a most significant bit of the third fuse word being different from 1.

10. The method of claim 9, wherein after exit from the reset, the integrated circuit is in the second state based on: the value of the third counter being greater than the value of the second counter; a most significant fuse bit of the first fuse word is in a programmed state; or a most significant fuse bit of the third fuse word is in a programmed state.

11. The method of claim 9, wherein the integrated circuit is in the first state based on: a value of the first counter being less than or equal to a value of the second counter; and a most significant bit of the third fuse word and the first fuse word is in an unprogrammed state.

12. An integrated circuit comprising: a fuse-type non-volatile memory; a processor; and a finite state machine configured to: verify a value of a first fuse word and a value of a second fuse word in the fuse-type non-volatile memory, the first fuse word representing a number of transitions of the integrated circuit to a first state, the second fuse word representing a number of transitions of the integrated circuit to a second state, based on verifying the value of the first fuse word and the value of the second fuse word, allow read access by the processor to a first region of the fuse-type non-volatile memory in the first state, and based on verifying the value of the first fuse word and the value of the second fuse word, disallow read access by the processor to the fuse-type non-volatile memory in a second state of the integrated circuit.

13. The integrated circuit of claim 12, wherein the verifying includes comparing the value of the first fuse word to the value of the second fuse word, and the verifying is based on a value of a most significant bit of the first fuse word.

14. The integrated circuit of claim 13, wherein the first state corresponds to a state of the integrated circuit in which: the value of the second fuse word is less than the value of the first fuse word, or a most significant bit of the first fuse word is blown.

15. The integrated circuit of claim 12, wherein the verifying is performed on each reset of the integrated circuit, and wherein scan testing of the integrated circuit is disallowed in the first state.

16. The integrated circuit of claim 12, wherein scan testing is enabled for the integrated circuit except for the fuse-type non-volatile memory in the second state.

17. The integrated circuit of claim 12, wherein a transition from the first state to the second state is performed only in response to a value from a reset exit corresponding to code stored in the first region of the fuse-type non-volatile memory, the value entered into a register from outside the integrated circuit while the integrated circuit is in reset, the code only readable by the finite state machine.

18. The integrated circuit of claim 17, wherein each transition of the integrated circuit to the first state is preceded by an increment of a first counter defined by the first fuse word, and wherein each transition of the integrated circuit to the second state is preceded by an increment of a second counter defined by the second fuse word.

19. The integrated circuit of claim 18, wherein the increment of the second counter is caused only by the finite state machine, and wherein the increment of the first counter is accessible by the processor.

20. The integrated circuit of claim 19, wherein when the integrated circuit is in the first state upon exiting from a reset, a value is introduced in a register such that a third counter defined by a third fuse word in the fuse-type non-volatile memory is incremented, a most significant bit of the third fuse word being different from 1.

21. The integrated circuit of claim 20, wherein, After exiting from the reset, the integrated circuit is in the second state based on: a value of the third counter being greater than a value of the second counter; a most significant fuse bit of the first fuse word being in a programmed state; or a most significant fuse bit of the third fuse word being in a programmed state.

22. The integrated circuit of claim 20, wherein the integrated circuit is in the first state based on: a value of the first counter being less than or equal to a value of the second counter; most significant bits of the third fuse word and the first fuse word being in a non-programmed state.

23. An apparatus comprising an integrated circuit, the integrated circuit comprising: a fuse-type non-volatile memory; a processor; and a finite state machine configured to: verify a value of a first fuse word and a value of a second fuse word in the fuse-type non-volatile memory, the first fuse word representing a number of transitions of the integrated circuit to a first state, the second fuse word representing a number of transitions of the integrated circuit to a second state, based on verifying the value of the first fuse word and the value of the second fuse word, allow read access to a first region of the fuse-type non-volatile memory by the processor in the first state, and based on verifying the value of the first fuse word and the value of the second fuse word, disallow read access to the fuse-type non-volatile memory by the processor in the second state of the integrated circuit.

24. The apparatus of claim 23, wherein the verifying comprises comparing the value of the first fuse word to the value of the second fuse word, and the verifying is based on a value of a most significant bit of the first fuse word.

25. The apparatus of claim 24, wherein the first state corresponds to a state of the integrated circuit in which: the value of the second fuse word is less than the value of the first fuse word, or the most significant bit of the first fuse word is blown. ​

Images