Debug Port Control Circuitry Against Fault Injection Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing integrated-circuit devices face vulnerabilities to fault injection attacks that can trick debug-port control circuitry into opening the debug port, compromising security by allowing unauthorized access to non-volatile memory.
Innovation Solution
Implementing a debug-port control circuitry that reads and verifies two distinct bit arrays from non-volatile memory, ensuring that both arrays meet specific predetermined patterns before allowing access, making it extremely difficult for attackers to trick the system into opening the debug port.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a single bit flag is used to control debug port access, then the device complexity is reduced and ease of operation is improved, but the reliability against fault injection attacks deteriorates
Solution Approach 1:
The patent divides the security verification into two separate bit arrays (first bit array and second bit array) stored at different predetermined locations in NVM. Each array is read and verified independently, with the debug port access granted only when both verification conditions are met. This segmentation prevents a single fault injection from compromising the entire security mechanism.
2Reliability
If fault injection attacks are defended against using multiple verification bits, then the reliability against attacks is improved, but the device complexity and manufacturing complexity increase
Solution Approach 1:
The patent combines the verification of two distinct bit arrays into a single read cycle, optimizing the security check process. The debug-port control circuitry is configured to read both the first bit array and the second bit array simultaneously from their respective predetermined locations in NVM during one read operation, then perform both pattern matching verifications and grant access only if both conditions are satisfied. This merging approach maintains manufacturing simplicity while enhancing security.
3Productivity
If a single read cycle is used to verify multiple bit arrays, then the productivity and speed of access control is improved, but the measurement precision of individual bit verification may deteriorate
Solution Approach 1:
The patent applies local quality by verifying each bit array against its specific predetermined pattern independently. The first bit array is matched against its designated pattern, and the second bit array is matched against its own designated pattern, with each verification having equal weight. This localized verification approach ensures that no single bit error can satisfy both verification conditions simultaneously, maintaining high measurement precision even within a single read cycle.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An integrated-circuit device (1) comprising a non-volatile memory (NVM) (15), a debug port (21), and debug-port control circuitry (17) for controlling access to the integrated- circuit device (1) through the debug port (21). The debug-port control circuitry (17) is configured to read a first bit array and a second bit array from respective predetermined locations in the NVM (15) in a single read cycle. The second bit array is distinct from the first bit array, and at least the second bit array contains a plurality of bits. The debug-port control circuitry (17) is further configured to determine whether the first bit array has a first predetermined bit pattern and whether the second bit array has a pattern other than a second predetermined bit pattern, and to control access through the debug port (21) at least partly in dependence on said determination.