Scan Chain Security Circuit With Dynamic Path Obfuscation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing scan chain security technologies are vulnerable to reverse engineering, allowing attackers to infer security keys due to one-to-one correspondence between patterns and keys, which can be exploited through pattern analysis.
Innovation Solution
A scan chain security circuit that obfuscates and normalizes pattern sequences using flip-flops, controlled by control signals generated from a linear feedback shift register, with dummy flip-flops and a scan data obfuscator to disrupt output patterns, breaking the one-to-one correspondence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a one-to-one correspondence between patterns and security keys is implemented, then pattern authentication is achieved, but security key extraction becomes easier through pattern analysis
Solution Approach 1:
The scan chain is divided into multiple segments with different scan chain control signals (SCCS1, SCCS2, etc.), allowing test patterns to be applied to different segments in different orders. This segmentation breaks the direct one-to-one correspondence between patterns and security keys, making pattern analysis attacks ineffective while maintaining authentication reliability
Solution Approach 2:
The patent implements dynamic reconfiguration of scan chain paths using control signals that can change the scanning order and path dynamically. Instead of a fixed pattern-key mapping, the system dynamically alters how patterns flow through the scan chain, preventing attackers from inferring security keys through static pattern analysis
2Reliability
If static obfuscation with invert or XOR gates is used, then basic security is provided, but security keys can be easily extracted through reverse engineering
Solution Approach 1:
The patent replaces static obfuscation with dynamic scan chain control mechanisms. Control signals dynamically determine the scanning path and order, providing security that adapts to different test scenarios rather than relying on fixed gate-level obfuscation that can be reverse engineered
Solution Approach 2:
The scan chain control signals serve multiple functions: they control the scanning path, determine pattern application order to different segments, and prevent key extraction. This multi-functionality provides robust security without requiring complex additional circuitry beyond the control signal generation
3Productivity
If multiple patterns are provided to test engineers, then comprehensive testing is enabled, but security key inference algorithms can be generated for each pattern
Solution Approach 1:
The test circuit is divided into multiple segments that can be independently tested with different patterns. Each segment has its own scanning control, allowing comprehensive testing coverage while preventing attackers from analyzing the complete pattern-key relationship across all segments simultaneously
Solution Approach 2:
The patent applies test patterns to different segments in different orders using pre-defined control signals. This preliminary arrangement of pattern application sequences prevents attackers from generating inference algorithms, as the relationship between patterns and security keys varies depending on which segment is being tested
Data Source
AI summary
A scan chain security circuit includes a scan chain including at least one flip-flop, a scan path obfuscator to obfuscate a path of a pattern sequence input to at least one first flip-flop grouped at an input side of the scan chain, in response to a first control signal, a scan path normalizer to normalize the path of the pattern sequence input to at least one second flip-flop grouped at an outside of the scan chain, in response to a second control signal, at least one dummy flip-flop interposed between the at least one first flip-flop and the at least one second flip-flop to receive a test key included in the pattern sequence, and a scan data obfuscator to damage and obfuscate an output pattern sequence output from the at least one second flip-flop, depending on whether a security key stored in a memory of a chip to be inspected is matched with the test key.