I. INTRODUCTION

Some emerging technologies, such as wireless sensor networks and internet of things ^(1-5), have been developed quickly in recent years and their security has been seriously concerned. Simultaneously, the security issue of the underlying hardware has also received more and more attentions ^(6-9). Scan-based design is one of the commonly used Design-for-Testability (DFT), which has significantly simplified the process of manufacturing test. However, due to its high controllability and observability, secret information inside chips may be stolen through this structure. Recently, the scan-based side-channel attacks have shown that attackers can analyze intermediate data to get important information inside chips through the scan design ^(10,11). Studies in ^(12-15) have shown that keys stored in chips with Advanced Encryption Standard (AES), RSA, Elliptic Curve Crypto systems (ECC) and Data Encryption Standard (DES) have been cracked successfully. To eliminate this potential crisis, many methods have been proposed.

A thorough way to defend against scan-based attacks is to cut off the polysilicon fuses after the test of the chip has been finished, which makes further access unavailable ⁽¹⁶⁾. However, this significantly compromises the testability because the scan chain is also used to connect to an external five-pin joint test action group (JTAG) interface which makes it capable to debug infield ⁽¹⁷⁾. BIST proposed in ^(18,19) does not need users’ test data and thus prevents attackers from accessing the secret key, but the fault coverage got compromised compared with the levels of scan test and ATPG.

Mirror Key Registers proposed in ⁽¹⁴⁾ is to isolate the key to an additional register to prevent it from entering the scan chain under test mode. Although simple and effective, the scheme considerably influences the test procedure. The method needs a separate test procedure in which the large part related to the key is tested in secure mode while another small part independent of the key is tested in insecure mode. The large test cost in secure mode adversely affects the test time and coverage. Advanced industrial DFT structures, like decompressors and X-masking in ⁽²¹⁾ which are considered firmly secure against scan-based attacks ⁽²²⁾, still have been attacked shown in ⁽²³⁾.

Instead of directly preventing from accessing the key information, Virtually Impervious Scan (VIm-Scan) ⁽²⁰⁾ uses an additional test key to realize the authentication before the data can be scanned out. It introduces a “pattern matching block” which stores a set of M N-bit test keys. Users must firstly input correct keys, otherwise the output will be all zeros. The main overhead of the scheme is dependent on the length and number of random test keys. The security of the scan design provided by this scheme relies on the probability of matching M N-bit test keys with input patterns loaded into the scan chain. The scheme can provide high security when M*N is enough large, but the scan-out data being all zeros when all test keys have not been matched may give attackers an obvious signal and there is no input restriction that allows attackers to wildly input. This may increase the possibility to crack the test keys.

In ⁽²⁵⁾, the authors propose a solution of obfuscating scan data to prevent attackers from analyzing the output data. The unauthenticated users should also firstly input an N-bit additional test key. After the N-bit test key has been loaded into SR (an additional chain designed to store the test key), the input of SR will be locked. When the test key is not correct, N scan flip-flops (SFFs) of scan chain randomly selected will dynamically change their mode between normal and test, which may fail attackers to analyze from the output data. The overhead of the scheme will increase with the increase of the length of the test key. When the length of test key is short, the time used to crack the test key will also be short. The similar schemes based on data obfuscation are also presented in ^(24,25,32).

In this paper, we will propose a new solution for obfuscating scan data with higher security and lower overhead. The rest of the paper is organized as follows. In Section II, we present the proposed technique. In Section III, experimental results are presented to analyze the proposed scheme. In Section IV, we will discuss an improved scheme against certain attacks. We conclude in Section V.

II. PROPOSED LOW-OVERHEAD SOLUTION AGAINST SCAN ATTACKS

The proposed secure scan design uses test authorization mechanism to protect the chip. It makes full use of the scan chain itself to store the test authorization key, i.e, some scan cells in the scan chain are chosen to serve as test authorization key storage units. If the users can not load the correct test authorization key at the beginning of testing, then the test input data can no longer enter the scan chain while the test output data will also be confused. The proposed secure scan design requires very low overhead, which is the most significant advantage compared with the existing similar schemes.

The proposed secure scan design is shown in Fig. 1. It separates the scan chain into three parts. The first part is used to store test authorization key, the third part is used to obfuscate scan data and the second part is used to generate the end flag while completely inputting the test authorization key. The secure scan design introduces N NAND gates which are hard-wired with the $Q$ or $\overline{Q}$ output of N randomly chosen scan flip-flops (marked as test key cells key[i]) among the first part of the scan chain. All the output of the N NAND gates are connected to a multiple-input AND gate G1, and the output of G1 is used as the clock signal of D1 which can lock the control signal EN to high level with a rising edge. The inverse of EN (i.e. $\overline{EN}$ ) is also wired to an input of each NAND gate. The value of key[i] (1≤i≤N) is decided by the connection style, i.e, key[i]=0/1 if the $Q$ /$\overline{Q}$ output is connected to the NAND gate. When the circuit is reset, $EN$=0 and $\overline{EN}$=1. After the right test key is loaded, $EN$ should become ‘1’. Otherwise, $EN$ keeps zero. The output of N NAND gates are also connected to some AND gates randomly inserted among the third part of the chain to obfuscate scan data when the inputted test key is incorrect.

The End_Flag signal, which is the $\overline{Q}$ output of an SFF (named flag scan flip-flop) randomly selected among the second part of the chain, is used to judge whether the test key has been delivered completely. When the circuit is reset, End_Flag=1. Once the scan test starts, a transition from low level (‘0’) to high level must be sent via SI as Start Signal. As SI transitions from ‘0’ to ‘1’, the $Q$ output of rising-edge flip-flop D2 becomes ‘1’. At this situation, input_lock signal (the output of AND gate G3) becomes ‘1’ since the output of D3 is 1 at the beginning. The tri-state buffer G4 is enabled, so the test key can be delivered. The test key should pass through the first part of the scan chain in which the authentication is performed.

Fig. 1. Proposed scan design with low overhead for obfuscating scan data.

When the Start Signal arrives in the flag scan flip-flop, End_Flag changes to low level (‘0’) which means the loading of the test key has been finished. Then the low-level value of End_Flag will be transmitted to the input restriction circuit between SI and the first SFF of the scan chain. If the loaded key is right, $EN$ should be changed from ‘0’ to ‘1’ before the Start Signal has been transmitted to the flag scan flip-flop. In this case, the output of NOR gate G2 will remain low level (‘0’) although the value of End_Flag changes later. So, the clock of D3 will never be activated, and input_lock will keep ‘1’. Then the scan chain will always work normally. If the loaded test key is wrong, $EN$ is still in low level (‘0’) when End_Flag changes to low level (‘0’). In this case, the output of NOR gate G2 will generate a transition from ‘0’ to ‘1’. So, the clock of D3 is activated, ‘1’ will be locked into D3, and input_lock will become ‘0’. The test data cannot be delivered from SI. The data of the first part of the chain will be shifted circularly to dynamically obfuscate the scan out data in the third part of the chain. Because the big AND gate G1 is also driven by input_lock, the test authorization key can be no longer checked for match after input_lock changes to ‘0’.

The timing diagrams of the signals during authentication process are shown in Fig. 2. M and P are the length of the first part of the scan chain and the location of flag SFF, respectively. In the figure we can see that End_Flag, input_lock and $EN$ are initialized to ‘1’, ‘0’, and ‘0’, respectively. The first “0®1” transition inputted from SI causes input_lock signal becoming high level to enable the input from SI. After M clocks, if the inputted test key is right, the $EN$ signal will change to high level and the input_lock will remain in high level. When the inputted test key is incorrect, the $EN$ signal will remain in low level and the input_lock signal will change to low level to switch the input of the scan chain from SI to End_Flag.

Users who want to correctly input the test key should firstly send a high level to enable the tri-state gate G4 connected with SI, which will also finally become the end flag signal outputted from the flag scan flip-flop mentioned above. Before End_Flag changes to low level, the right test key should be inputted. Otherwise, the SI of the chain will be locked and the data in the first part of the scan chain will be shifted circularly clock by clock. One input of the AND gate inserted in the third part of the chain is fed by a test key cell via a NAND gate. If the input is 0, the adjacent SFF can only receive zero. The scan-out obfuscation arises if the real value is ‘1’.

Fig. 2. Timing diagram of the signals in authentication operation.

The proposed scheme just introduces the input restraint circuitry, a multiple-input AND gate and some NAND gates which brings slight impact on the chip implementation flow. Details will be discussed as follows. Because we just use some outputs of scan cells among the first part of the scan chain as signals to realize authentication, and insert some AND gates on scan path in the third part, there will be no impact to the design and layout of the original design. After the secure scan design insertion and placement, the tests will be performed by fab, assembly and other testers in supply chain. These authorized testers just need to input test patterns generated before and analyze the responses.

In addition, the proposed scheme can also be used to strengthen the security of the scan-tree in ⁽³³⁾. We can randomly choose a scan path in the tree to serve as the scan chain in Fig. 1. Once the test key is wrong, the input of the root node will be disabled and the data obfascation will occur at leaf nodes of the tree.

III. ANALYSIS AND RESULTS

In this section, We will analyze the testability, security and overhead of the proposed design. Then we will compare our design with some other countermeasures.

IV. AN IMPROVED SCHEME AGAINST CERTAIN ATTACK

In some situations, adversaries may know the exact positions of critical registers in the scan chain. With the information of these positions, they can construct a specific set of sequences and analyze from the primary output response to steal secret information. As such attack is based on the knowledge of the positions of critical registers in the scan chain, with our design, such attack will take effect only when these critical registers are all distributed among the first part of the scan chain. To eliminate such potential crisis, we can use the structure shown in Fig. 3 in some critical registers to resist such attack. We use an OR gate with input of the inverse of $EN$ and TC to lock some critical registers’ mode to normal mode. When $EN$ is in low level, the output of the OR gate should always be in high level. The inputs of these registers are bypassed by additional registers which can also be used as test key registers. When $EN$ changes to high level, the output of these 2-to-1 multiplexers controlled by $EN$ will change to the original SFFs’ output and the scan chain will work normally.

Fig. 3. Improved secure scan design against certain attack.

These 2-to-1 multiplexers are located in the scan path. When the circuit is working normally, the additional logic will keep inactive because the signal will no longer go through these 2-to-1 multiplexers. Thus, no extra timing overhead is increased in the normal mode

V. CONCLUSIONS

In this paper, we have illustrated a simple and effective scheme with very low overhead and enough security for obfuscating scan data against scan-based side-channel attacks in cypher chips. The method provides security by restricting the input and dynamically obfuscating scan-out data to prevent attackers from wildly inputting data and analyzing secret information from the output data. The proposed solution costs significantly low overhead compared to existing schemes and can easily improve the security by adding test key length with just some NAND gates.