KR20190083996A - Apparatus and method for protecting data in test mode - Google Patents

Abstract

Disclosed are an apparatus and a method for protecting data in a test mode. The apparatus for protecting data comprises: a first AND operator performing an AND operation on a scan mode signal for determining whether to operate in one of the scan mode and the normal mode, and on a delay signal in which the scan mode signal is delayed for a predetermined time; and a second AND operator performing an AND operation on a scan reset signal for determining whether to reset the operation result output from the first AND operator and a register value. Then, whether to reset the register value is finally determined based on the final reset signal output from the second AND operator.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention [0001] The present invention relates to a data protection apparatus,

The following description relates to a data protection apparatus and method in a test mode, and more particularly, to an apparatus and method for protecting data in a scan test mode.

BACKGROUND ART As a method of testing semiconductor devices such as integrated circuit chips, a scan test method is widely used.

Generally, a scan test is performed by replacing a flip-flop in a logic circuit with a scan flip-flop and configuring a scan flip-flop in one or a plurality of shift chains, A method of repeatedly performing shift input, parallel loading, and shift output is often used.

However, if important information such as a key register is stored in the integrated circuit chip, it is impossible to exclude the possibility of attempting to hack important information using the scan test mode. Therefore, there is a need for a method capable of preventing leakage of important information and safely protecting data in response to an external attack using the scan test mode.

The present invention can safely protect data without leakage even if a hacking of important information inside the chip is attempted through the scan test mode.

The present invention can be provided with an apparatus and a method for preventing a key value that is inevitably to be protected from being leaked when chip hacking is attempted to extract important information (e.g., a key value) in the chip through the scan test mode .

The present invention can protect a register value from an external attack by controlling a scan mode reset state by combining a scan test mode and a scan reset.

A data protection apparatus according to an embodiment of the present invention includes a scan mode signal for determining whether to operate in a scan mode or a normal mode, an AND operation for delaying the scan mode signal by a predetermined time, A first AND operator (AND operator) for performing the first AND operation; And a second end operator for performing an end operation on a scan reset signal for determining whether to reset the operation result and the register value output from the first end operator, wherein the second end operator is based on the final reset signal output from the second end operator And whether to reset the register value is finally determined.

The data protection device according to an embodiment may further include a plurality of flip-flops (F / Fs) connected in series, and the plurality of flip-flops may delay the scan mode signal by a predetermined time .

In the data protection apparatus according to an exemplary embodiment, the register value may be reset if the last reset signal output from the second end operator is low, and the register value may be active if the last reset signal is high.

A data protection apparatus according to an embodiment includes a flip-flop having a register value disposed at an output terminal of a path in which scan logic is not configured; And a selection element for outputting either one of the register value and predetermined data output from the flip-flop, based on the STM signal.

In the data protection device according to an exemplary embodiment, the selection element may output the register value if the STM signal is low and may output the predetermined data if the STM signal is high.

In a data protection apparatus according to an embodiment, the flip-flop may be a positive edge-triggered static D-type flip-flop.

In a data protection apparatus according to an embodiment, the flip-flop may be an FD2SQ cell operating as a control cell for improving test faults coverage.

The data protection method according to an embodiment of the present invention includes a delay signal delaying a scan mode signal for determining whether to operate in a scan mode or a normal mode by a predetermined time and a first end operation on the scan mode signal ; And performing a second end operation on a scan reset signal that determines whether the result of the first end operation and the register value is reset, wherein the second end operation is performed based on a final reset signal resulting from the second end operation, Whether or not to reset the value can be finally determined.

In the data protection method according to an exemplary embodiment, the register value may be reset if the last reset signal output from the second end operator is low, and the register value may be active if the final reset signal is high.

According to an exemplary embodiment, when an attempt is made to switch to a scan test mode while operating in the normal mode, and when an attempt is made to switch to the scan mode, the register value is always cleared to prevent a register value including important information from being leaked .

According to one embodiment, in the scan test mode, the scan control cell can be controlled to make a register having important information a fixed value.

According to one embodiment, the test time and coverage of the chip can be improved together by using the scan test mode, and the key value, which is important data in the security chip, can be protected by the scan attack, have.

According to one embodiment, a device containing an important register value to be protected in a scan test mode may be protected by a scan control cell.

1 is a block diagram illustrating a data protection apparatus according to an exemplary embodiment of the present invention.
FIG. 2 and FIG. 3 are timing charts for explaining the operation of the data protection apparatus according to one embodiment.
4 is a diagram illustrating a data protection apparatus according to another embodiment of the present invention.
FIG. 5 is a table for explaining the operation of the flip-flop included in the data protection apparatus according to another embodiment.
6 is a diagram illustrating a data protection method according to an embodiment of the present invention.

Specific structural or functional descriptions of embodiments are set forth for illustration purposes only and may be embodied with various changes and modifications. Accordingly, the embodiments are not intended to be limited to the particular forms disclosed, and the scope of the present disclosure includes changes, equivalents, or alternatives included in the technical idea.

The terms first or second, etc. may be used to describe various elements, but such terms should be interpreted solely for the purpose of distinguishing one element from another. For example, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component.

It is to be understood that when an element is referred to as being "connected" to another element, it may be directly connected or connected to the other element, although other elements may be present in between.

The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises ", or" having ", and the like, are used to specify one or more of the described features, numbers, steps, operations, elements, But do not preclude the presence or addition of steps, operations, elements, parts, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning of the context in the relevant art and, unless explicitly defined herein, are to be interpreted as ideal or overly formal Do not.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. The specific structural or functional descriptions below are illustrated for purposes of illustration only and are not to be construed as limiting the scope of the embodiments to those described in the text. Those skilled in the art will appreciate that various modifications and changes may be made thereto without departing from the scope of the present invention. In addition, the same reference numerals shown in the drawings denote the same members, and the well-known functions and structures are omitted.

The data protection device according to an embodiment may be a device that prevents an external attacker from leaking a register value even if an external attacker tries to attack the chip to find the register value using the scan mode. Here, the register value may include a PUF random number, a TRNG random number generator random number, and the like as a key value to be protected.

The data protection apparatus according to the embodiment can reset the register value when switching to the scan mode so that the register value including the important information does not leak while the scan mode is changed from the normal mode. In the scan mode, a scan pattern is input to a scan path through a scan input port of a chip including a circuit to be tested, and an output value output through the scan output port is set in a predetermined It is possible to indicate a mode for a scan test in which a chip is checked for a defect by comparing with a predicted value.

In addition, the data protection apparatus according to another embodiment can control the register value including important information to be output as a predetermined fixed value in the scan mode.

Hereinafter, the operation of the data protection apparatus will be described in detail with reference to the drawings.

1 is a block diagram illustrating a data protection apparatus according to an exemplary embodiment of the present invention.

Referring to FIG. 1, the data protection apparatus 100 includes a first AND operator 110 and a second end operator 130.

The first AND operator 110 adds a scan mode signal SCAN_MODE for determining whether to operate in a scan mode or a normal mode and an AND operation for a delay signal SM_DLY for delaying the scan mode signal SCAN_MODE by a predetermined time, ). For example, if the scan mode signal SCAN_MODE is low, the chip operates in the normal mode, and if the scan mode signal SCAN_MODE is high, the chip can operate in the scan mode.

The scan mode signal SCAN_MODE may be delayed by a predetermined time by a plurality of flip-flops (F / Fs) 120 connected in series. The plurality of flip-flops 120 is a non-scan flip flop (none scan F / F), and a scan reset signal SCAN_RESET corresponding to an asynchronous active-low reset (RN) and a scan clock signal SCAN_CLOCK . The output of the previous flip-flop is input to the next flip-flop, and thus the delay signal SM_DLY in which the scan mode signal SCAN_MODE is delayed by a predetermined time while passing through the plurality of flip-flops can be determined.

The first AND operator 110 may output a low-level operation result SM_RST if at least one of the scan mode signal SCAN_MODE and the delay signal SM_DLY is low. Alternatively, if the scan mode signal SCAN_MODE and the delay signal SM_DLY are both high, the first AND operator 110 can output the operation result SM_RST which is high.

The second AND operation unit 130 performs an AND operation on the operation result SM_RST output from the first AND operator 110 and the scan reset signal SCAN_RESET for determining whether to reset the register value. Whether to reset the register value can be finally determined based on the last reset signal SCAN_RST output by the end operation of the second AND operation unit 130. [

For example, the scan reset signal SCAN_RESET is a signal for determining the operation state of the chip. If the scan reset signal SCAN_RESET is high, the chip is operated in the active state. If the scan reset signal SCAN_RESET is low, .

The second end operator 130 may output the last reset signal SCAN_RST that is low if at least one of the operation result SM_RST and the scan reset signal SCAN_RESET is low. Alternatively, the second end operator 130 may output the final reset signal SCAN_RST, which is high if the operation result SM_RST and the scan reset signal SCAN_RESET are both high.

The final reset signal SCAN_RST is proposed in the present invention in order to protect the register value which is important data from the external attack, and it can be ultimately determined whether the register value is reset based on the final reset signal SCAN_RST. For example, if the last reset signal SCAN_RST is high, the chip operates in an active state so that the register value is not reset, and if the last reset signal SCAN_RST is low, the register value can be reset.

FIG. 2 and FIG. 3 are timing charts for explaining the operation of the data protection apparatus according to one embodiment.

In a scan mode for a scan test according to an exemplary embodiment, there is a possibility that important data (for example, a PUF key, a public key, an encryption key, etc.) to be protected at any time through pattern analysis is seized by an attacker. To cope with such an external attack, it is necessary to distinguish between two operation sections. In other words, it can be divided into a normal operation section for performing a scan test and a physical attack section using a scan test. At this time, the physical attack period using the scan test may indicate a period in which the scan mode signal SCAN_MODE changes from high to low while the scan mode is not normally terminated.

In a normal operation period according to an exemplary embodiment, the chip should operate normally and the register key should not be stolen in a physical attack period using a scan test.

To this end, when the chip is operating normally, all data is stored in the register cell, and a fixed value may be output when the register cell is reset. Even if the register cell has any value, the cell can be initialized by resetting and the register value stored before the register value is taken can be deleted.

Referring to FIG. 2, a timing chart illustrating a process of determining a final reset signal when a scan mode is changed from a normal mode in a normal operation period in which a scan test according to an exemplary embodiment is performed.

A SCAN backdoor attack according to an exemplary embodiment may attempt to hack a register value when switching from the normal mode to the scan mode. In other words, when switching from the normal mode to the scan mode, it may become an attack point. At this time, if the scan reset is not performed, the register value of the normal mode may be maintained before the scan mode is changed, so an extra measure is necessary.

Therefore, when the conversion into the scan mode is requested during the operation in the normal mode, resetting all the register values can initialize all the values to prevent the register value from being taken. This may be referred to as scan mode reset logic (SCAN Mode Reset logic).

In Fig. 2, as the scan mode signal SCAN_MODE is changed from low to high, the operation mode of the chip can also be changed from the normal mode to the scan mode. The delay signal SM_DLY may be delayed by a predetermined time (i.e., a timing delay) and changed from low to high. The operation result SM_RST determined based on the scan operation between the scan mode signal SCAN_MODE and the delay signal SM_DLY can be changed from low to high when the scan mode signal SCAN_MODE and the delay signal SM_DLY are both high. Then, the final reset signal SCAN_RST output from the second end operator can be changed from low to high when the operation result SM_RST and the scan reset signal SCAN_RESET are both high. In FIG. 2, the scan reset signal SCAN_RESET is not shown for convenience of explanation.

Referring to FIG. 3, there is shown a timing chart illustrating a process of determining a final reset signal when a scan mode is changed to a normal mode in a physical attack period using a scan test according to an exemplary embodiment.

A scan backdoor attack according to an exemplary embodiment may attempt to take a register value when starting operation in a scan mode. In other words, the start point of the scan mode can be an attack point. When the operation is started in the scan mode, the specific position value is continuously changed in the register value. Therefore, the register value may be hacked by analyzing the change pattern of the plurality of chips.

Therefore, when the operation is started in the scan mode, all the register values are reset, so that all values can be initialized to prevent the register value from being stolen. This may be referred to as scan mode reset logic (SCAN Mode Reset logic).

In Fig. 3, as the scan mode signal SCAN_MODE changes from high to low, the operation mode of the chip can also be changed from the scan mode to the normal mode. The delay signal SM_DLY can be delayed by a predetermined time (i.e., a timing delay) and changed from high to low. The operation result SM_RST determined based on the scan operation between the scan mode signal SCAN_MODE and the delay signal SM_DLY can be changed from high to low when at least one of the scan mode signal SCAN_MODE and the delay signal SM_DLY is changed to low. The final reset signal SCAN_RST output from the second end operator can be changed from high to low when at least one of the operation result SM_RST and the scan reset signal SCAN_RESET is changed to low. In FIG. 3, the scan reset signal SCAN_RESET is not shown for convenience of explanation.

4 is a diagram illustrating a data protection apparatus according to another embodiment of the present invention.

According to an exemplary embodiment, the register value which is a key may be controlled to be output as a fixed value in the scan mode, which may be referred to as a scan control fixed cell logic (scan_control_fix_cell logic).

The control cell may be configured at the output of the path where the SCAN logic is not configured to be used to improve Test Faults Coverage. Also, an Observe Cell can be configured at the input of a path where the scan logic is not configured to be used to improve test coverage of the test.

These control cells and observation cells are commonly used in scanning, and they are vulnerable to a scan backdoor attack and require additional measures.

In particular, a value used as a unique key for each chip, such as a PUF key, can be exploited through pattern analysis of eigenvalues through observation cells in a scan mode, which can be an attack vulnerability. Such an attack can be easily solved by a simple structure that outputs fixed data (such as Scan Fixed Data (SF)) to the input / output of the logic to be protected in scan mode.

Referring to FIG. 4, a data protection apparatus 400 according to another embodiment includes a flip-flop 410 and a selection element 420.

The flip-flop 410 is disposed at an output terminal of a path where scan logic is not configured, and has a register value. The flip-flop 410 may be a positive edge-triggered static D-type flip-flop. In addition, the flip-flop 410 may be an FD2SQ cell operating as a control cell for improving test faults coverage.

The selection element 420 outputs either a register value output from the flip-flop and predetermined data based on the STM signal. The selection element 420 outputs a register value if the STM signal is low and outputs predetermined data if the STM signal is high. In Fig. 4, the row is indicated by "0" and the high is indicated by "1 ".

As described above, the data protection device 400 outputs a fixed value in the scan mode, thereby preventing the register value from being stolen by an external attack.

FIG. 5 is a table for explaining the operation of the flip-flop included in the data protection apparatus according to another embodiment. The flip-flop is a positive edge-triggered static D-type flip-flop, FD2SQ cell, which has a scan input (TI), an active-high scan enable (TE), an asynchronous active- an asynchronous active-low reset (RN), and a single output (Q).

6 is a diagram illustrating a data protection method according to an embodiment of the present invention.

In step 610, the data protection apparatus performs a first end operation on a delay signal and a scan mode signal, which are delayed by a predetermined time, on a scan mode signal for determining whether to operate in a scan mode or a normal mode do.

In step 620, the data protection device performs a second end operation on the scan reset signal, which determines whether the result of the first end operation and the register value is reset. It is finally determined whether to reset the register value based on the last reset signal that is the result of the second end operation. For example, if the last reset signal output from the second end operator is low, the register value is reset, and if the final reset signal is high, the register value may be active.

The steps described above with reference to FIGs. 1 through 5 are applied to each step shown in FIG. 6 as it is, and a detailed description will be omitted.

The embodiments described above may be implemented in hardware components, software components, and / or a combination of hardware components and software components. For example, the devices, methods, and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, such as an array, a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

The components described in the embodiments may be implemented by a programmable logic device such as one or more DSP (Digital Signal Processor), a processor, a controller, an application specific integrated circuit (ASIC), and a field programmable gate array Logic Element, other electronic devices, and combinations thereof. ≪ RTI ID = 0.0 > At least some of the functions or processes described in the embodiments may be implemented by software, and the software may be recorded in a recording medium. The components, functions and processes described in the embodiments may be implemented by a combination of hardware and software.

Although the embodiments have been described with reference to the drawings, various technical modifications and variations may be applied to those skilled in the art. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

100: Data protection device
110: first end operator
120: a plurality of flip-flops
130: second end operator

Claims (9)

A first AND operator (AND) for performing an AND operation on a scan mode signal for determining whether to operate in a scan mode or a normal mode and a delay signal for delaying the scan mode signal by a predetermined time, operator); And
A second AND operation unit for performing an AND operation on a scan reset signal for determining whether to reset the operation result and the register value output from the first end operator,
Lt; / RTI >
And whether to reset the register value is finally determined based on the last reset signal output from the second end operator.
The method according to claim 1,
A plurality of flip-flops (F / Fs)
Further comprising:
Wherein the plurality of flip-flops delay the scan mode signal by a predetermined time.
The method according to claim 1,
Wherein the register value is reset when the last reset signal output from the second end operator is low and the register value is active when the last reset signal is high.
A flip-flop having a register value disposed at an output terminal of a path where scan logic is not configured; And
A selection element for outputting either one of the register value and predetermined data output from the flip-flop based on the STM signal;
. ≪ / RTI >
5. The method of claim 4,
The selection element
And outputs the register value if the STM signal is low and outputs the predetermined data if the STM signal is high.
5. The method of claim 4,
The flip-
A data protection device that is a positive edge-triggered static D-type flip-flop.
5. The method of claim 4,
Wherein the flip-flop is an FD2SQ cell operating as a control cell for improving test faults coverage.
Performing a first end operation on a scan signal and a delay signal in which a scan mode signal for determining whether to operate in a scan mode or a normal mode is delayed by a predetermined time; And
Performing a second end operation on a scan reset signal for determining a result of the first end operation and resetting the register value
Lt; / RTI >
Wherein whether to reset the register value is finally determined based on a final reset signal resulting from the second end operation.
9. The method of claim 8,
Wherein the register value is reset when the last reset signal output from the second end operator is low and the register value is active when the last reset signal is high.

Images