SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Security Design for IEEE P I 687

laken avatar
laken
26 diapositives · 635 Views · Jan 26, 2013

The security risks associated with IEEE P1687 (IJTAG), a standard for on-chip instrument access. We introduce the structure and functionality of P1687, discuss security design considerations including expected unlocking times, and propose improvements to mitigate risks. The discussion includes possible break-in procedures, different security levels based on access times, and strategies to enhance protection through mechanisms like Secure LFSR (SLFSR). Our findings emphasize the necessity of defensive architectures in safeguarding sensitive on-chip data.

#ieee p1687 #security risks #ijtag #onchip instruments #breakin procedures #slfsr #security levels #defensive architecture
Security Design for IEEE P I 687 - slide 1
01 / 26Security Design for IEEE P I 687
1 / 17

Télécharger la présentation

Security Design for IEEE P I 687
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Security Design for IEEE P1687 Hejia Liu Major Professor: Vishwani D. Agrawal

  2. Introduction • Part1:IntroductionofIEEEP1687 (IJTAG) securityrisksinP1687 • Part2:Security design and expected unlocking time • Part3:Discussion of a proposalandimprovementin security Liu: MEE Project

  3. IEEE 1149.1 (JTAG) Interface Liu: MEE Project

  4. What is P1687/ IJTAG? • IEEE P1687 is a valuable tool for accessing on-chip instruments during test, diagnosis, debug and board configurations. • P1687 is a proposed IEEE Standard that has 3 components • A flexible set of serial scan chain techniques for the instrument access architecture (called the network) • Anetworkdescriptionlanguage(calledinstrumentconnectivity language, ICL) • An instrument vector language (called procedure description language, PDL) Liu: MEE Project

  5. CommunicationbetweenChips An example of communication P1687 network between 3 chips Liu: MEE Project

  6. Instruments, IPs • An IP(Intellectual property core) with a P1687 compliant interface is named instrument. • IPs: Analog, digital or mixed signal circuitry performing particular functions, such as a clock a generator, an interface to an external measurement probe, a radio tuner, an analog signal converter, a digital signal processor, etc. Liu: MEE Project

  7. P1687Network Rst Optional Liu: MEE Project

  8. FSM ofTAP Controller Liu: MEE Project

  9. Security Risks • Depending on the application, data may be stored on-chip, including chip ID, codes, and encryption keys. • An attacker can access a targeted instrument and obtain the secret data easily. Liu: MEE Project

  10. A Possible Break-in Procedure • Step 1: Load Instruction code in TAP • Step 2: Shift in an attempt vector • Step 3: Clock the TAP controller • Step 4: If attempt successful, access instrument • Step 5: Else, repeat from step 2 Liu: MEE Project

  11. Security Levels • Insecurity: Break-in time at the level of days • Weak security: Break-in time at the level of years • Strong security: Break-in time at the level of ten years • Full Security: Break-in time in the level of thousand years Liu: MEE Project

  12. Structure of SIB(Segment Insertion Bit) Select=1 ShiftEn=1 To_TDO1 To_TDI2 0 1 0 1 0 1 TDI Update cell 1 Select Shift cell From_TDO2 ShiftEn Select TCK UpdateEn Liu: MEE Project

  13. Structure of SIB(Segment Insertion Bit) Select=0 ShiftEn=1 To_TDO1 To_TDI2 0 1 0 1 TDI 0 1 Update cell 0 Select Shift cell From_TDO2 ShiftEn Select TCK updateEn Liu: MEE Project

  14. The Structure of SIB(Segment Insertion Bit) ShiftEn=0 UpdateEn=1 To_TDO1 To_TDI2 0 1 0 1 0 1 TDI Update cell 1 Shift cell 1 Select From_TDO2 ShiftEn Select TCK UpdateEn Liu: MEE Project

  15. Dworak, et al.. ,”Don’t forget to lock your SIB:Hiding instrument using P1687,” ITC 2013 Locking-SIBWithTrap To_TDO1 To_TDI2 0 1 0 1 RST 0 1 TDI Update cell Shift cell From_TDO1 ShiftEn Select TCK UpdateEn Key[0] Key[n] Trap feedback select signal Whether the key and trap feedback value is 1 or 0 is decided by structure Select Liu: MEE Project

  16. Unsecure and Secure P1687 Networks Liu: MEE Project

  17. Dworak, et al.,“Don’t forget to lock your SIB: Hiding instrument using P1687,” ITC 2013 Break-in Procedure Cost(LSIB unlock attempt w/Trap) Prob(opening SIB with key of k bits) = Expected Cost(LSIB unlock w/Trap) ) Liu: MEE Project

  18. Expected Results (f = 100MHz) Liu: MEE Project

  19. Features of Secure Structure • The order of magnitudes for break-in time: • An attacker uses the scan chain length as a feedback • What if we hide the length of the scan path? Liu: MEE Project

  20. An Original Proposal: Use SLFSR (Secure LFSR) to Hide Scan Path Length Liu: MEE Project

  21. SLFSR Example 3-stage SLFSR, R= Liu: MEE Project

  22. Break-in Procedure 1 attempt= n* Liu: MEE Project

  23. Attacker’s Strategies • Condition 1: Attempt length is n*< N • Condition 2: Attempt length is n*= N • Condition 3: Attempt length n*> N Liu: MEE Project

  24. Expected Results (f = 100MHz) • Condition 3: Liu: MEE Project

  25. Disadvantage Compared to Structure without SLFSR In fact, we are increasing the feedback keys alternately. For the secure chain without LFSR,   without LFSR = For the secure chain in the worst case condition (condition 3) : = Comparing 2 equations, for large n, the efficiency ratio: Liu: MEE Project

  26. Conclusion • It is useful we replace the non-functional segments with SLFSR • Security SLFSR increases attacker’s effort as breaking not only depends on the structure we build up, but also the strategies that attacker chooses. • We should be concerned about the “lucky” attacker Liu: MEE Project