[et_pb_section admin_label=”section” background_color=”#6f9a48″ inner_shadow=”on” fullwidth=”on” transparent_background=”off” allow_player_pause=”off” parallax=”off” parallax_method=”off” padding_mobile=”off” make_fullwidth=”off” use_custom_width=”off” width_unit=”on” make_equal=”off” use_custom_gutter=”off”][et_pb_fullwidth_header admin_label=”Fullwidth Header” title=”Design-for-Secure-Testability” background_layout=”dark” text_orientation=”left” header_fullscreen=”off” header_scroll_down=”off” parallax=”off” parallax_method=”off” content_orientation=”center” image_orientation=”center” custom_button_one=”off” button_one_letter_spacing=”0″ button_one_use_icon=”default” button_one_icon_placement=”right” button_one_on_hover=”on” button_one_letter_spacing_hover=”0″ custom_button_two=”off” button_two_letter_spacing=”0″ button_two_use_icon=”default” button_two_icon_placement=”right” button_two_on_hover=”on” button_two_letter_spacing_hover=”0″ subhead_font_size=”1px”] [\/et_pb_fullwidth_header][\/et_pb_section][et_pb_section admin_label=”Section” fullwidth=”off” specialty=”off”][et_pb_row admin_label=”Row”][et_pb_column type=”1_3″][et_pb_image admin_label=”Scan arch key Image” src=”https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-content\/uploads\/2016\/06\/scan_arch_key.png” alt=”Scan arch key” title_text=”Scan arch key” show_in_lightbox=”off” url_new_window=”off” use_overlay=”off” animation=”off” sticky=”off” align=”left” force_fullwidth=”off” always_center_on_mobile=”on” use_border_color=”off” border_color=”#ffffff” border_style=”solid”] [\/et_pb_image][et_pb_image admin_label=”iterative core Image” src=”https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-content\/uploads\/2016\/06\/iterative_core.png” alt=”iterative core” title_text=”iterative core” show_in_lightbox=”off” url_new_window=”off” use_overlay=”off” animation=”off” sticky=”off” align=”left” force_fullwidth=”off” always_center_on_mobile=”on” use_border_color=”off” border_color=”#ffffff” border_style=”solid”] [\/et_pb_image][\/et_pb_column][et_pb_column type=”2_3″][et_pb_text admin_label=”Text” background_layout=”light” text_orientation=”left” text_font_size=”16″ use_border_color=”off” border_color=”#ffffff” border_style=”solid”]<\/p>\n
Scan is NOT Secure [\/et_pb_text][et_pb_text admin_label=”Text” background_layout=”light” text_orientation=”left” use_border_color=”off” border_color=”#ffffff” border_style=”solid”]<\/p>\n While testing is required to screen out defective Integrated Circuits (ICs), any design effort to improve testability may compromise the security of the ICs. To enhance the testability, the test infrastructure provides internal access to the IC. However, an attacker can leverage the test mode to hack into secure-critical ICs. An IC may embed a secret key used to perform on-chip encryption\/decryption, or a microprocessor may have an Intellectual Property (IP) instruction set hardcoded into its ROM; such security-critical data must be protected from attacks that misuse test infrastructure.<\/p>\n While scan delivers the desired access into flip flops of the design, it also reveals the intermediate computations within a security-critical chip. In-field testing and debug is thus enabled at the expense of potential security compromise. Access to scan chains can be misused by an attacker to leak<\/em> data that can infer on-chip secret information; this attack is known as scan-based side-channel attack<\/em>, where the attacker applies plaintext input from the primary inputs in the functional mode, and then switches to the test mode to shift out the intermediate results through the scan interface.<\/p>\n Scan-based side channel attack relies on the condition that the intermediate results should be preserved upon a switch between the normal mode and the test mode. However, the widely used simple mode-reset countermeasure<\/em>, i.e., an automatic reset operation upon a switch between the normal mode and the test mode, successfully thwarts these attacks.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row admin_label=”Row”][et_pb_column type=”4_4″][et_pb_text admin_label=”Text” background_layout=”light” text_orientation=”left” text_font_size=”16″ use_border_color=”off” border_color=”#ffffff” border_style=”solid”]<\/p>\n Test-Mode-Only (TMO) Attack for Basic Scan [c72<\/a>, c73<\/a>, c79<\/a>, c84<\/a>, c85<\/a>, c86<\/a>, c89<\/a>] [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row admin_label=”Row”][et_pb_column type=”1_3″][et_pb_image admin_label=”boundary scan Image” src=”https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-content\/uploads\/2016\/06\/boundary-scan.png” alt=”boundary scan” title_text=”boundary scan” show_in_lightbox=”off” url_new_window=”off” use_overlay=”off” animation=”off” sticky=”off” align=”left” force_fullwidth=”off” always_center_on_mobile=”on” use_border_color=”off” border_color=”#ffffff” border_style=”solid”] [\/et_pb_image][et_pb_image admin_label=”mapping Image” src=”https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-content\/uploads\/2016\/06\/mapping.png” alt=”mapping” title_text=”mapping” show_in_lightbox=”off” url_new_window=”off” use_overlay=”off” animation=”off” sticky=”off” align=”left” force_fullwidth=”off” always_center_on_mobile=”on” use_border_color=”off” border_color=”#ffffff” border_style=”solid”] [\/et_pb_image][\/et_pb_column][et_pb_column type=”2_3″][et_pb_text admin_label=”Text” background_layout=”light” text_orientation=”left” use_border_color=”off” border_color=”#ffffff” border_style=”solid”]<\/p>\n The mode-reset countermeasure can only be circumvented if the scan attack remains in the test mode. In the presence of boundary scan DfT, however, the attacker has no direct access to the primary inputs in the test mode. Rather, the attacker has only access to the scan input pins to feed the cipher round register.<\/p>\n Also, the mapping between scan cells to round registers is unknown as the physical placement tools decide how these flip-flops are connected. We propose an attack, Test-Mode-Only attack, that uses the JTAG port and the basic test capabilities. The scan-attack comprises only shift and capture operations, all performed within the test mode, in order to first identify the mapping between the registers and the scan cells, and next to infer the secret key from the intermediate results.<\/p>\n Test-mode-only attack for basic scan architecture can identify the unknown mapping between the scan cells and the inputs of the AES by creating test vectors to launch the desired bit-flips and observing their effect on the output bits as we show in our papers c72<\/a>, c73<\/a>, c79<\/a>, c84<\/a>, c85<\/a>, c86<\/a>, and c89<\/a>.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row admin_label=”Row”][et_pb_column type=”4_4″][et_pb_text admin_label=”Text” background_layout=”light” text_orientation=”left” text_font_size=”16″ use_border_color=”off” border_color=”#ffffff” border_style=”solid”]<\/p>\n Test-Mode-Only (TMO) Attack in the Presence of Scan Compression [c81<\/a>, c82<\/a>, c83<\/a>, j43<\/a>, j51<\/a>] [\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row admin_label=”Row”][et_pb_column type=”1_3″][et_pb_image admin_label=”scan compression Image” src=”https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-content\/uploads\/2016\/06\/scan-compression-1.png” alt=”scan compression” title_text=”scan compression” show_in_lightbox=”off” url_new_window=”off” use_overlay=”off” animation=”off” sticky=”off” align=”left” force_fullwidth=”off” always_center_on_mobile=”on” use_border_color=”off” border_color=”#ffffff” border_style=”solid”] [\/et_pb_image][\/et_pb_column][et_pb_column type=”2_3″][et_pb_text admin_label=”Text” background_layout=”light” text_orientation=”left” use_border_color=”off” border_color=”#ffffff” border_style=”solid”]<\/p>\n In contemporary test infrastructures that support scan compression, due to the correlation induced by the stimulus decompressor, the attacker may no longer be able to apply the desired test patterns to launch the desired bit-flips; a single bit-flip may trigger an unwanted bit-flip in other locations, resulting in ambiguous or incorrect deductions in the scan attack. A stimulus decompressor and a response In our work in c81<\/a>, c82<\/a>, c83<\/a>, j43<\/a>, and j51<\/a>, we identified the conditions for a successful attack in the presence of a scan decompressor and a compactor, and developed countermeasures (decompressor output swapping and scan cell swapping) to ensure that these conditions are never met. The techniques we propose deliver design-for-secure-testability.<\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" Scan is NOT Secure While testing is required to screen out defective Integrated Circuits (ICs), any design effort to improve testability may compromise the security of the ICs. To enhance the testability, the test infrastructure provides internal access to the IC. However, an attacker can leverage the test mode to hack into secure-critical ICs. An […]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":125,"menu_order":4,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"class_list":["post-471","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-json\/wp\/v2\/pages\/471","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-json\/wp\/v2\/comments?post=471"}],"version-history":[{"count":27,"href":"https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-json\/wp\/v2\/pages\/471\/revisions"}],"predecessor-version":[{"id":524,"href":"https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-json\/wp\/v2\/pages\/471\/revisions\/524"}],"up":[{"embeddable":true,"href":"https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-json\/wp\/v2\/pages\/125"}],"wp:attachment":[{"href":"https:\/\/sites.nyuad.nyu.edu\/dfx\/wp-json\/wp\/v2\/media?parent=471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n<\/strong><\/p>\n
\n<\/strong><\/p>\n
\n<\/strong><\/p>\n
\ncompactor thus end up acting as a natural fortuitous countermeasure for the proposed test-mode-only attacks as they reside on the scan path, further complicating the test-mode-only attack.<\/p>\n