CLK
TEST MODE
SCAN ENABLE
SCAN ENABLE (INTERNAL)
RESET SCAN RESET SCAN EXIT
1
METHOD AND APPARATUS FOR SECURE
SCAN TESTING
CROSS-REFERENCE TO RELATED
APPLICATION 5
The present application is a continuation application of U.S. patent application Ser. No. 10/135,877 (issued as U.S. Pat. No. 7,185,249), entitled "Method and Apparatus for Secure Scan Testing" and filed on Apr. 30, 2002, the entirety 10 of which is incorporated by reference herein.
FIELD OF THE DISCLOSURE
The present disclosure relates generally to processor scan- 15 testing, and more particularly to scan testing secure devices.
BACKGROUND
In its most basic form, a scan-chain is a series of elements linked together so that an output of one element is linked to an 20 input of the next element in the series, which in turn has an output linked to an input of a subsequent element, and so on. Sometimes, circuit designers use scan-chains to provide test access to internal elements of a processor that would be otherwise inaccessible. By using a scan chain, a test engineer 25 can shift data into a processor sequentially, using a single input port. The processor operates on the data, and the results of the operations are then read out sequentially using a single output port. In this way a maximum amount of internal circuitry can be tested with a minimum of additional complexity. 30
This ease of testing, however, gives rise to data access issues that must be taken into consideration, especially in light of the encryption and security requirements of the software, telecommunications, entertainment, and other industries. For example, the telecommunications industry has a 35 need to have secure codes stored in some of the semiconductor chips used to process information in mobile phones, pagers, and the like. These secure codes may be used as part of proprietary data processing methods, for hardware identification and authentication, to specify a secure state, or for any 40 number of other purposes. However, if the circuitry responsible for handling these codes is accessible via a scan chain, competitors might be able to exploit the scan chain to gain access to the secure codes stored in the chip or to enter a secure state. 45
In order to address the problem of exploiting the scan chain to gain access to secure information stored in the chip or to fool the chip into thinking it is in a secure state, manufacturers have generally removed circuitry used to process secure information from the scan chain. By removing this circuitry 50 from the scan chain, it becomes more difficult for unauthorized users to gain access to the secure codes. However, this solution leaves a significant portion of the chip unable to be completely tested.
As should be apparent from the above discussion, currently 55 available testing methodologies are less than ideal, in that they force a designer to choose either test access with decreased data security, or data security without test access for significant portions of a data processor. What is needed is some way to permit test access to portions of a processor that 60 process secure information, but maintaining the secrecy of any secure information in the processor.
BRIEF DESCRIPTION OF THE DRAWINGS
65
Various advantages, features and characteristics of the present disclosure, as well as methods, operation and func
2
tions of related elements of structure, and the combination of parts and economies of manufacture, will become apparent upon consideration of the following description and claims with reference to the accompanying drawings, all of which form a part of this specification.
FIG. 1 is a block diagram of a processor employing a scan controller according to an embodiment of the present disclosure;
FIG. 2 is a flow chart illustrating a method of scan testing that includes clearing sensitive data before allowing access to scan-observable portions of a processor according to an embodiment of the present disclosure;
FIGS. 3-5 are logic diagrams illustrating scan controllers for controlling access to a scan chain according to various embodiments of the present disclosure;
FIG. 6 is an exemplary timing diagram illustrating the timing of the logic diagram shown in FIG. 3 associated with entry into a test mode; and
FIG. 7 is an exemplary timing diagram illustrating the timing of the logic diagram shown in FIG. 3 associated with exit from a test mode.
DETAILED DESCRIPTION OF THE FIGURES
In the following detailed description of the figures, the terms "assert" and "negate" (or "de-assert") are used when referring to the rendering of a signal, status bit, or similar apparatus into its logically true or logically false state, respectively. If the logically true state is a logic level one, the logically false state is a logic level zero. And if the logically true state is logic level zero, the logically false state is a logic level one.
Therefore, each signal described herein may be designed as positive or negative logic, where negative logic can be indicated by bar over the signal name or an asterisk (*) following the name. In the case of a negative logic signal, the signal is active low where the logically true state corresponds to a logic level zero. In the case of a positive logic signal, the signal is active high where the logically true state corresponds to a logic level one.
FIGS. 1-7 illustrate how a scan controller can be used in an information processor to provide a level of protection from electronic hacking by preventing access to sensitive information via processor test modes. The manner in which security is maintained allows for increased component test coverage, without sacrificing the security of sensitive information. This increased test coverage should, in turn, allow less costly product testing and quicker time to market.
To maintain the security of sensitive data, one embodiment described herein clears read-sensitive security data from scan-observable portions of the processor prior to enabling access to the scan chain, and clears write-sensitive security data prior to exiting test mode and resuming normal operation. Clearing sensitive portions of the scan chain at these times will prevent unauthorized personnel from simply scanning out secure data, and from pre-loading elements on the scan chain prior to normal operation in order to set sensitive state information.
Referring first to FIG. 1, a processor employing a scan controller according to the teachings set forth herein will be discussed, and is designated generally as processor 100. Processor 100 includes a series of latches 182-188 and state machine 150 that lie on scan chain 180; various sources of sensitive information, such as secure key 130 and secure random access memory (RAM) 140; and scan controller 120, which controls access to scan chain 180 and provides reset and/or mode configuration signals. Processor 100 also
3
includes encrypt block 110 for encrypting user data, and RAM reset 170 to clear information from secure RAM 140. Note that while only certain elements are shown as being on scan chain 180, any element for which scan testing is desired, for example encrypt block 110, may also be placed on scan 5 chain 180.
The information to be protected from access may include information stored in processor 100 during manufacture, such as hardwired identification keys and proprietary hardware/firmware implemented algorithms, or sensitive infor- 10 mation stored after manufacturing. For example, secure key 130 may be a hardware identification key used to identify a particular mobile communication device, and state machine 150 may be a series of logical elements that are used by processor 100 to determine if the processor is in a secure 15 operational mode. In each of these cases, the information built into processor 100 needs to be kept secure in order to discourage counterfeiting, or to make reverse engineering by competitors more difficult.
While secure key 130 may be implemented during manu- 20 facture, secure RAM 140 is one way to implement secure information storage in processor 100 after completion of the manufacturing process. For example, assume processor 100 is a graphics processor used in a wireless Internet appliance. If a particular service provider has a proprietary graphics 25 compression algorithm, the provider can load the encrypted algorithm into processor 100 via user data input 109. Processor 100 would then decrypt the algorithm using encrypt block 110, and forward the decrypted data for storage in secure RAM 140. It will be appreciated that suitable methods of 30 storing information in processor 100, in addition to or in place of those illustrated in FIG. 1, may be employed by those skilled in the art without departing from the teachings set forth herein.
Latches 182,184,186, and 188 are capable of functioning 35 in both a normal mode and a test mode. In normal mode latches 182 and 184, as well as state machine 150, hold sensitive information for use by other portions of processor 100. For example, latch 182 may be one of a number of latches used to access secure key 130 and deliver secure key 40 130 to an authentication portion (not illustrated) of processor 100. As another example, an encrypted software subroutine may be passed from secure RAM 140 to a central processing unit through latch 184. When latches 182 or 184 contain information that should not be accessed without proper 45 authority, the latches are said to contain read-sensitive information.
State machine 150 may hold data that places processor 100 in a non-secure mode. If the state data in state machine 150 could be altered just prior to exiting a scan-mode, the proces- 50 sor could be tricked into believing that it is in a non-secure mode, thereby possibly compromising secure operation. Data that needs to be protected from being stored after scan mode operation may be referred to as write-sensitive data. Other latches (not illustrated) may be used for storing outputs of 55 other state machines (not illustrated) which may contain read or write sensitive information. In each of these examples, the security of the data could be compromised if access to the scan chain was not protected.
In test mode, latches 182,184, 186 and latches associated 60 with state machine 150 are observable outside processor 100 via scan chain 180. Access to scan chain 180 is provided by scan-in port 181, and scan-out port 189. Data is clocked into latch 182, the first scan-observable latch on scan chain 180, via scan-in port 181. Each time data is clocked into latch 182, 65 the output data at latch 182 is sent to the input of latch 184. Each time the output data of latch 182 is sent to the input of
4
latch 184, the output data latch 184 is sent to the input of latch 186, and so on, until the data travels all the way through the chain to scan-out port 189. For example, assume that in the illustrated scan chain 180, a logic 1 is clocked into latch 182 during the first clock cycle. During the second clock cycle, the logic 1 stored in latch 182 will be delivered to latch 184. During the third clock cycle that same logic one would be sent to latch 186. The process would continue until, finally, the logic 1 would be transferred to readout latch 188 and made available for readout on scan-out port 189 during the fourth clock cycle. Those skilled in the art will appreciate that this simple example is merely illustrative, and that data shifted into a particular latch may be manipulated in various ways before being sent through the remainder of scan chain 180.
In the illustrated embodiment, readout latch 188, in contrast to latches 182,184 and state machine 150, does not hold sensitive data during a normal mode. Instead, readout latch 188, under control of scan controller 120, blocks readout of data from the scan chain except under certain predetermined conditions. It will be appreciated that, while not illustrated, a latch controlled in a manner similar to readout latch 188 could be used at the input to scan chain 180 to block any data from being scanned in. It will also be appreciated that in other embodiments, such as in various embodiments discussed hereinafter, readout latch 188 is not used.
Scan controller 120 controls access to scan chain 180, and consequently controls access to any sensitive information that may be stored in latches 182,184 and state machine 150. In at least one embodiment, scan controller 120 receives as input a TEST MODE signal, a SCAN ENABLE signal, a RESET signal, and an EVENT TRIGGER signal. Using these input signals scan controller 120 generates a SCAN ENABLE (INTERNAL) signal and a SCAN DATA ENABLE signal, which are used to configure latches 182-188 and state machine 150 to allow scan-testing. For example, an asserted SCAN ENABLE (INTERNAL) places each scan latch in scan mode, while an asserted scan data enable allows data to be scanned to the scan out port 189. Scan controller 120 also generates SCAN EXIT and SCAN RESET signals that are used to reset elements on scan chain 180 as needed.
In the illustrated embodiment, scan controller 120 controls most reset sequences associated with scan chain 180, ensuring that each of latches 182-188 and state machine 150 are properly reset as required. Note that in the illustrated embodiment, latches 186 and 188, which are not used to store sensitive information, need not be reset to protect sensitive information. However, since it may be desirable to reset latches 186 and 188 during a "hard" reset or at other times, the RESET input to scan controller 120 is provided to reset latches 186, 188. In other embodiments, the RESET signal may be provided to secure scan chain elements, for example state machine 150, in addition to the SCAN RESET signal. While it may be desirable in many circumstances to reset every element on the scan chain, non-sensitive elements may be left un-reset by outputs of scan controller 120 without departing from the teachings set forth herein.
RAM reset 170 is used in one embodiment to clear information from secure RAM 140 in response to some event. RAM reset 170 may be controlled by a separate reset state machine (not illustrated), directly by scan controller 120, or otherwise. RAM reset 170 may also provide an EVENT TRIGGER signal indicating that data stored in secure RAM 140 has been successfully cleared. This output signal could be used as the EVENT TRIGGER input for scan controller 120. Use of the EVENT TRIGGER signal can be particularly useful when the time necessary to reset secure RAM 140 is indeterminate. It will be appreciated that although RAM reset
5
170 is used in the illustrated embodiment, it is not necessary for every embodiment. In at least one embodiment, generation of a SCAN DATA ENABLE signal, a SCAN ENABLE (INTERNAL) signal, and an EVENT TRIGGER signal or other similar signal is controlled, at least in part, by a signal 5 (not shown in FIG. 1) indicating whether or not data contained in elements of scan chain 180 has been secured by performing a reset or otherwise. One embodiment of such a signal is the UNSECURE* signal, discussed subsequently with respect to FIG. 5. 10
Referring next to FIG. 2, a method of scan testing a processor such as processor 100 (FIG. 1) according to an embodiment of the present disclosure will be discussed. The method begins in step 210, with processor 100 operating in a normal, or non-test, mode. In normal mode, elements of scan 15 chain 180 are used in performing ordinary processing tasks. While the elements on scan chain 180 are in normal mode, they are not accessible via SCAN-IN port 181 or SCAN-OUT port 189, because latches 182-188 and state machine 150 are not configured to receive or send information via their scan- 20 chain ports. In normal mode, latches 182, 184 and state machine 150 may contain sensitive data or state information, so that if the elements on scan chain 180 could be enabled for scan-chain access during normal operations, any information contained in the elements of the scan chain could be read out 25 of scan-out port 189, possibly compromising the security of the information.
The method proceeds to step 220, in which the scan chain is prepared for testing by resetting, or otherwise modifying sensitive data in scan chain latches 182, 184 and state 30 machine 150 in response to a desired input or combination of inputs. For example, in one embodiment, receipt of an asserted TEST MODE signal and an asserted SCAN ENABLE signal will cause scan controller 120 to generate an asserted SCAN RESET signal that can be applied directly to 35 the reset pins of latches 182, 184 and state machine 150. Alternatively suitable hardware, software or firmware controller could modify the data in latches 182, 184 and state machine 150, randomly or otherwise, to ensure that no secure data can be retrieved from the latches. 40
In step 230, the scan controller checks that any sensitive data has been cleared or otherwise modified. Step 230 may check for the presence of an asserted EVENT TRIGGER signal at an input to scan controller 120, and if the EVENT TRIGGER signal is not asserted, then the SCAN ENABLE 45 (INTERNAL) signal is not asserted. For example, if it is desired to reset secure ram 140 before allowing access to scan chain 180, then scan controller 120 could wait for a signal from ram reset 170 indicating that a reset of secure ram 140 had been completed. In other embodiments, no EVENT 50 TRIGGER signal is needed because the timing for modification of data in scan-chain elements is deterministic, and step 230 is accomplished simply by waiting a number of clock cycles sufficient to allow latches 182-184 to be reset.
Once the sensitive data has been modified in step 230, scan 55 controller 120 allows access to scan chain 180 in step 240. During step 240, normal scan testing procedures known to those skilled in the art can be employed without sacrificing the security of sensitive information that may have been previously stored in any of the scan-observable elements of scan 60 chain 180. Data can be scanned into SCAN-IN port 181 and read out from SCAN-OUT port 189 for testing the functionality of various internal portions of processor 100.
When scan testing is complete, the method of FIG. 2 proceeds from step 240 to step 250. In step 250, preparations are 65 made to exit scan testing mode and reenter normal mode. In one embodiment, during step 250, access to scan chain 180 is
6
blocked and any data in latches 182, 184 and state machine 150 is modified or reset. Scan chain 180 may be blocked by notifying scan controller 120 (FIG. 1) to enter a normal mode by de-asserting the TEST MODE signal. In response to deasserting the TEST MODE signal, a SCAN RESET SIGNAL may be asserted to reset latches 182, 184 and state machine 150 (FIG. 1), and any other elements of scan chain 180 that may include read or write sensitive information. In addition, elements on the observable portion of the scan chain may be reconfigured to prevent data from being scanned out. The signals used to prepare the scan chain for normal operation are described in greater detail with reference to FIG. 7.
Clearing information from scan-observable portions of processor 100 before exiting to a non-test state prevents someone from scanning in "seed" information during a scan test, and then monitoring the outputs of processor 100 to determine what operations have been performed on the seed information. Clearing the information at this point also prevents someone from setting a state machine, for example state machine 150, to a particular state which could, for example, "trick" the processor into believing it is operating in a secure mode, when in fact it is not. In at least one embodiment, a SCAN EXIT signal generated during step 250 may be used as an input to various state machines to indicate that the current state may not be accurate, in place of or in addition to modifying/resetting the data as discussed in the previous paragraph. The state machines can then transition to a known state on its own, even if the state bits are not cleared on scan exit.
In step 260 scan controller 120 checks to make sure that data is cleared from any necessary scan-observable portions of processor 100 by using the same or similar techniques as those discussed in regard to step 230. For example, in one embodiment scan controller 120 may wait for assertion of an EVENT TRIGGER signal to indicate that a reset has completed before asserting a SCAN DATA ENABLE signal, which may be used to allow or prevent data from being shifted into or out of scan chain 180. In another embodiment, which will be discussed in greater detail subsequently with respect to FIG. 5, de-assertion of an UNSECURE* signal may be predicated upon assertion of an EVENT TRIGGER signal.
The UNSECURE* signal, which will be discussed with reference to FIG. 5, may be used to control one or more elements on scan chain 180 to prevent or allow configuration of various elements on scan chain 180 for normal operations. For example, UNSECURE* may be used in place of a control signal, such as the SCAN DATA ENABLE signal illustrated in FIG. 1 to prevent data from being output. Alternatively, UNSECURE* may be used as one input to a logic circuit used to generate one or more signals, for example SCAN DATA ENABLE or SCAN ENABLE (INTERNAL). In at least one embodiment, the UNSECURE* signal (FIG. 5) combines the functionality of both SCAN RESET and SCAN EXIT signals (FIGS. 3-4). Once the data and/or state information is cleared, then scan controller 120 or another suitable hardware, software or firmware element can return processor 100 to normal mode.
It will be appreciated that the various steps of the method of FIG. 2 may be implemented concurrently or in a different order without departing from the teachings set forth herein. For example, checking to see that sensitive data is cleared from scan-observable elements as in step 230 may be performed during normal mode 210 in addition to being performed after step 230. Alternatively, checking whether or not sensitive data has been cleared may be performed continuously. Also, depending on various design, marketing, cost, security or other factors, certain portions of the method described in FIG. 2 may be implemented exclusive of other
|
