Secure JTAG Debugging via Challenge-Response Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure debugging circuits, particularly those using JTAG ports, are vulnerable to replay and dictionary attacks, and face challenges in managing multiple passwords and providing secure access controls, leading to increased authentication times and potential malicious access.
Innovation Solution
A challenge-response authentication method using a public key cryptosystem is implemented, where a response server verifies user requests and generates access control signals based on user-provided information, allowing secure activation or deactivation of JTAG port access, and includes an attack detection mechanism to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password authentication is used for JTAG port security, then authentication can be implemented, but the system becomes vulnerable to replay attacks and dictionary attacks, and password management becomes complex when multiple passwords are required
Solution Approach 1:
The patent transforms the authentication mechanism from password-based to challenge-response based on device identity. Instead of using static passwords that are vulnerable to attacks, the system uses dynamic challenge-response pairs generated through cryptographic operations, fundamentally changing the authentication parameter from static credential to dynamic verification
Solution Approach 2:
The patent introduces a response server as an intermediary between the debugging device and the target device. This intermediary manages the challenge-response authentication process, generates unique challenges, and verifies responses, thereby eliminating the need for direct password sharing and reducing vulnerability to attacks
2Adaptability or versatility
If multiple passwords are assigned to different access controls, then individual access control is provided, but authentication time increases and password management becomes difficult
Solution Approach 1:
The patent creates a universal challenge-response authentication framework that can handle multiple access control levels without requiring separate password management. The same authentication mechanism serves multiple purposes: identifying devices, verifying user credentials, and granting appropriate access levels based on the challenge-response outcome
3Ease of operation
If JTAG port provides high controllability and observability on AP chip, then debugging capability is enhanced, but malicious users can exploit this for malicious access
Solution Approach 1:
The patent applies preliminary anti-action by implementing authentication verification before allowing any JTAG port access. The challenge-response mechanism is executed in advance to verify the legitimacy of the debugging device, preventing malicious users from exploiting the high controllability and observability features before authorization is confirmed
Data Source
AI summary
A method of debugging a device which includes a plurality of processors is provided. The method includes verifying a request to initiate authentication that is provided to the device to a user; performing a challenge-response authentication operation between the user and the device in response to the request to initiate authentication being a request from a non-malicious user; activating or deactivating an access to a Joint Test Action Group (JTAG) port of each of the processors, based on access control information from the user; and permitting a debugging operation via an access that is activated.