Manufacturing Test of Secure Devices: Threats Introduced by Test Infrastructures

Manufacturing testing is used to weed out defective products and it is considered as a necessary task in the IC production process to ensure quality. The fastest and best cost-effective solution for digital testing is based on the use of scan-chains. Unfortunately, this solution can allow a malicious user to exploit this test infrastructure and retrieve secret information stored within the integrated circuit. The antagonism between scan-based Design-for-Testability (DfT) and security comes from their competing goals: improving controllability and observability of internal states for increased testability, and preventing control or observation of these internal states for increased security. This lecture will describe solutions from the literature to counteract possible attacks targeting malicious usage of scan chains and, more generally, all test infrastructures and test standards, by covering the security threats of IEEE 1149, 1500 and 1687. The lecture will conclude with the description of some common industrial practices.

  • Part 1: Test of Secure Devices and Scan-Chain Attacks
    • VLSI testing principles
    • Basic Scan Based Attack
    • Improved Attacks:
      • On multiple scan chains
      • With test data compression
      • With partial scan
      • From Scan-In
      • Test-only mode
  • Part 2: Countermeasures
    • BIST
    • Secure Test Access Mechanism
    • Obfuscation and Encryption of the scan path
    • Industrial solutions
  • Part 3: Test Standards and Security
    • IEEE 1149, 1500, 1687
    • Attacks exploiting test standards
    • Verification of Security in Reconfigurable Scan Networks (IEEE 1687)