New Scan-Based Attack Using Only the Test Mode and an Input Corruption Countermeasure

Abstract

Scan-based design-for-testability, which improves access and thus the test quality, is highly vulnerable to scan attack. While in-field test is enabled through the scan design to provide debug capabilities, an attacker can leverage the test mode to leak the secret key of the chip. The scan attack can be thwarted by a simple defense that resets the data upon a switch from the normal mode to the test mode. We proposed a new class of scan attack in [15] using only the test mode of a chip, circumventing this defense. In this book chapter we extend our earlier work by introducing case studies to explain this new attack in greater detail. Furthermore, we study the effectiveness of existing countermeasures to thwart the attack and propose a new input corruption countermeasure that requires a smaller area overhead compared to the existing countermeasures.

Secure Test with RSNs: Seamless Authenticated Extended Confidentiality

“…On the other hand, it is nowadays well-known that these facilities may be a dangerous entry point into the circuit, and can be exploited by malicious third-parties [4]- [6]. Potential threats can materialize as sensitive data leakage [7], device tampering to induce improper behavior [8], or theft of Intellectual Properties (IPs) [9]. Among the different solutions related to the vulnerabilities and security of the test infrastructure, a large effort has been 1 Institute of Engineering Univ.…”