Semiconductor device with high security having JTAG ports

A semiconductor device includes JTAG ports receiving integrally command information representing a command and password information representing a password, a processor for performing a process in response to the command, an output port outputting consequence information representing a consequence of the process, a transfer section for transferring the command to the processor and for transferring the consequence information to the output port, and a cut off section. The cutoff section cuts off at least one of transferring the command information to the processor and transferring the consequence information to the output port when the password does not match a predetermined proper password. Thus, the semiconductor device can advantageously heighten its security effect.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to a semiconductor device having a JTAG (Joint Test Action Group) port.

2. Description of the Background Art

In recent years, some of semiconductor devices such as a system LSI (Large Scale Integration) have JTAG ports as interfaces for connecting inspection devices. The semiconductor devices are also provided with memories such as a flash ROM (Read-Only Memory) in their inside that have security bits so that the security bits prevent program sequences stored in memories from being read out and rewritten through their JTAG ports.

In this kind of semiconductor device, when its security bit is enabled, access from its JTAG port to its inside is cut off so as to prevent programs stored in a memory from being read out and rewritten.

Well, even if the semiconductor device switches the security bit to its enabled state after writing a finished program, the program may need to rewritten due to the discovery of a bug or change in its specifications.

However, in this kind of semiconductor device, when the security bit is enabled and the access from its JTAG port to its inside is cut off, it may be disadvantageous that the semiconductor device must be abandoned, and that, according to circumstances, a whole apparatus including the semiconductor device must be replaced.

Japanese Patent No. 3760087 discloses a semiconductor device that enables access from its JTAG port to its inside in spite of a state that its security bit is enabled. The semiconductor device in the Japanese patent is provided with general-purpose ports. In the semiconductor device, when an input state resultant from decoding the state on one or more of the general-purpose ports matches a predetermined pattern, access from its JTAG port to its inside is enabled.

A microcomputer disclosed in the Japanese patent laid-open publication No. 2002-183108 enables access from its JTAG port to its inside in spite of a state that its security bit is enabled when data having a predetermined pattern is inputted to the JTAG port.

According to the Japanese patent and laid-open publication described above, even if a security bit is enabled, access from the JTAG port of the device to the inside allows rewriting the security bit to be disabled so that a program sequence stored in its inside can be read out and rewritten.

However, in the Japanese patent and laid-open publication described above, it is disadvantageous to not necessarily heighten security effect because access from the JTAG port to the inside allows a program sequence to be read out and rewritten when the security bit is disabled.

SUMMARY OF THE INVENTION

It is an object of the present invention to provide a semiconductor device that can heighten the security effect.

In accordance with the present invention, a semiconductor device comprises an input port to which command information representing a command and password information representing a password is integrally inputted, a processor operative in response to the command represented by the command information inputted for performing a process to produce consequence information representative of the consequence of the process, an output port outputting the consequence information, a transfer section for transferring the command information from the input port to the processor and for transferring the consequence information from the processor to the output port, and a cutoff section for cutting off at least one of transferring the command information to the processor and transferring the consequence information to the output port when the password represented by the password information inputted does not match a predetermined proper password.

In accordance with the invention, the input port receives the command information representing the command and the password information representing the password integrally, the processor is operative in response to the command represented by the command information inputted to the input port to perform the process to produce the consequence information as its performance consequence, the output port outputs the consequence information representing the performance consequence of the process by the processor, and the transfer section transfers the command information inputted to the input port to the processor and transfers the consequence information from the processor to the output port.

When the password represented by the password information inputted to the input port does not match the predetermined proper password, the cutoff section cuts off at least one of transferring the command information to the processor and transferring the consequence information to the output port.

Thus, the command information representing the command and the password information representing the password are inputted integrally to the input port, and at least one of transferring the command information to the processor and transferring the consequence information to the output port are cut off when the password represented by the inputted password information does not match the predetermined proper password. The semiconductor device in accordance with the invention can therefore advantageously heighten its security effect.

In accordance with an aspect of the invention, the semiconductor device may further comprise a generator for producing a new password at a predetermined timing, and a comparator for comparing the password represented by the password information inputted with the password produced by the generator.

In accordance with another aspect of the invention, the predetermined timing may be defined as time when the processor performs the process in response to a predetermined command.

As stated above, in accordance with the semiconductor device according to the present invention, the command information representing the command and the password information representing the password are integrally inputted to the input port. The processor in the semiconductor device performs processes in response to the command represented by the command information to produce the consequence information as its performance consequence. When the password represented by the inputted password information does not match the predetermined proper password, the semiconductor device cuts off at least one of transferring the command information to the processor and transferring the consequence information to the output port. The semiconductor device can therefore advantageously heighten its security effect.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

With reference to the accompanying drawings, a preferred embodiment of a semiconductor device according to the present invention will be described in detail. Also, it is noted that in the following description the semiconductor device is applied to a system LSI (Large Scale Integration)10.

As shown inFIG. 1A, the system LSI10in the embodiment is connected to an ICE (In-Circuit Emulator)12that is an inspection device inspecting the system LSI10.

As shown inFIG. 1B, the system LSI10includes a JTAG (Joint Test Action Group) port20, an input/output tri-state circuit22, a TAP (Test Access Port) controller24, a key data cell26, an input data cell28, an output data cell30, a CPU (Center Processing Unit)32, a memory34r a key detector36, a terminal pattern detector38, and a dual-input/single-output AND gate40, which are interconnected as illustrated.

The system LSI10is connected to an ICE12through the JTAG port20. The JTAG port20is adapted to receive or output JTAG signals102-110, and comprised of five JTAG port terminals20A-20E. The system LSI10is adapted to receive an input data signal (TDI)102, a clock signal (TCK)104, a mode select signal (TMS)106, and a reset signal (TRST)108vie the terminals20A-20D, and output an output data signal (TDO)110vie the terminal20E, as JTAG signals

The JTAG port20is connected to the TAP controller24through the input/output tri-state circuit22.

The input/output tri-state circuit22is configured to receive an enable signal S20described below on its control terminal, and to control input/output and cutoff of the JTAG signals102-110in response to the enable signal S20.

The TAP controller24controls the operation of the entire LSI10in response to a JTAG command represented by the JTAG signals102-108inputted on the JTAG port20, and controls to output a signal110from the inside of the LSI10from the JTAG port20. The TAP controller24in accordance with the embodiment develops the inputted TDI signal102as an inside TDI signal S1. In addition, the TAP controller24outputs a debug control signal S16corresponding to the JTAG command represented by the inputted TMS signal106. The debug control signal S16represents commands of “capture”, “shift”, and “run” corresponding to a JTAG capture command, a JTAG shift command, and a JTAG run command, respectively, by a value represented by the debug control signal S16.

The key data cell26, the input data cell28, and the output data cell30in accordance with the embodiment include responsive serial connections, each of which includes a plurality (three in the embodiment) of flip-flop circuits (F/Fs). The key data cell26, the input data cell28, and the output data cell30are also connected to the TAP controller24to receive the debug control signal S16.

The flip-flop circuit at the first stage of the key data cell26has its input terminal connected to the TAP controller24to receive the inside TDI signal S1. The flip-flop circuit at the final stage of the key data cell26has its output terminal connected to an input terminal of the flip-flop circuit at the first stage of the input data cell28. Each of the flip-flop circuits in the key data cell26has its output terminal connected to an input terminal of the key detector36.

In the key data cell26, when the inputted debug control signal S16represents “shift”, each flip-flop circuit shifts data latched by itself to output the data to the stage subsequent thereto and latch data inputted from the stage preceding thereto. Thus, the key data cell26shifts data inputted on the inside TDI signal S1to transfer the data in the flip-flop circuits in order, and outputs the data from the flip-flop circuit at the final stage to the input data cell28every time the debug control signal S16of “shift” is inputted.

In addition, in the key data cell26, when the inputted debug control signal S16represents “run”, each flip-flop circuit outputs the data latched by itself to the key detector36as a key data signal S17.

As stated above, the input terminal of the flip-flop circuit at the first stage of the input data cell28is connected to the output terminal of the flip-flop circuit at the final stage of the key data cell26to receive data outputted from the key data cell26. Each of the flip-flop circuits in the input data cell28has its output terminal connected to the CPU32.

In the input data cell28, when the inputted debug control signal S16represents “shift”, each flip-flop circuit shifts data latched by itself to output the data to the stage subsequent thereto and latch data inputted from the stage preceding thereto.

In addition, in the input data cell28, when the inputted debug control signal S16represents “run”, each flip-flop circuit outputs the data latched by itself to the CPU32as a debug input signal S14.

The CPU32is connected to the TAP controller24to receive the debug control signal S16. The CPU32is connected to the memory34via a bus S15.

The CPU32, when the inputted debug control signal S16represents “run”, interprets a command represented by the debug input signal S14inputted from the input data cell28to read out or write data from or to the memory34depending upon a result of the interpreting. The CPU32outputs data thus read out from the memory34as a debug output signal S13.

Each of the flip-flop circuits in the output data cell30has its input terminal connected to the CPU32to receive the debug output signal S13outputted from the CPU32. The flip-flop circuit at the final stage of the output data cell30has its output terminal connected to the TAP controller24.

In the output data cell30, when the inputted debug control signal S16represents “capture”, each flip-flop circuit latches the debug output signal S13outputted from the CPU32.

In addition, in the output data cell30, when the inputted debug control signal S16represents “shift”, each flip-flop circuit shifts data latched by itself to output the data to the stage subsequent thereto and latch data inputted from the stage preceding thereto. Thus, the key data cell26shifts data latched by each flip-flop circuit in order, and outputs the data from the flip-flop circuit at the final stage to the TAP controller24as an inside TDO signal S2every time the debug control signal S16of “shift” is inputted.

The terminal pattern detector38receives a pattern input terminal signal S12representing the input state of a predetermined general-purpose port, not shown. The terminal pattern detector38, when powered on for driving, compares the input state of the general-purpose port represented by the pattern input terminal signal S12with a pattern stored in advance. If the result of the comparison shows the input state being matched with the predetermined pattern, then a terminal pattern enable signal S8is switched to its assert state. Otherwise, the terminal pattern enable signal S8is switched to its negate state.

The key detector36is connected to the TAP controller24to receive the debug control signal S16.

The key detector36is adapted to output a key pattern enable signal S19, and enable the key pattern enable signal S19to be asserted when the key detector36is powered on for driving.

The key detector36, when the inputted debug control signal S16represents “run”, compares information represented by the key data signal S17inputted from the key data cell26with an appropriate password stored in advance. If the result of the comparing indicates the information not matching with the predetermined password, then the key pattern enable signal S19is switched to its negate state. Once the key pattern enable signal S19is switched to its negate state, the key detector36holds the negate state while the power for driving is supplied.

Thus, once the key pattern enable signal S19is switched to its negate state, it is not switched to its assert state until the supply of the power for driving stops.

The AND gate40has its one input terminal connected to the terminal pattern detector38, and its other input terminal connected to the key detector36. The key pattern enable signal S19and the terminal pattern enable signal S8are inputted to the respective input terminals.

The AND gate40outputs a signal resultant from the AND of the key pattern enable signal S19and the terminal pattern enable signal S8to the elements of the input/output tri-state circuit22in the form of enable signal S20. The enable signal S20is switched to its assert state when both the key pattern enable signal S19and the terminal pattern enable signal S8are the assert state thereof. By contrast, the enable signal S20is switched to its negate state when at least one of the key pattern enable signal S19and the terminal pattern enable signal S8is its negate state.

Now, returning toFIG. 1A, the ICE12in accordance with the embodiment includes a host interface50, a command generator52, a key data memory54, and a JTAG interface controller56, which are interconnected as illustrated.

The host interface50is connected to, and serves to interface with, a host device14, such as a personal computer (PC), which controls the operation of the ICE12. The personal computer14outputs various commands to the host interface50in order to control an inspection for the system LSI10, and receives data inside the LSI10through the host interface50.

The key data memory54stores beforehand password data representing a password to be attached to data when the system LSI10is tested.

The command generator52is connected to the host interface50, the key data memory54, and the JTAG interface controller56to receive various commands in order to control the inspection for the system LSI10from the host interface50.

The command generator52interprets a command inputted from the personal computer14through the host interface50, converts the command to a corresponding JTAG command, attaches the password data stored in the key data memory54to the JTAG command, and outputs the resultant data to the JTAG interface controller56. The command generator52is also adapted to receive data inputted from the JTAG interface controller56, and output the data to the personal computer14through the host interface50.

Next, the operation of the system LSI10in accordance with the embodiment will be described. The following will be directed to an exemplified case where the personal computer14reads out once a piece of data stored in the memory34provided for the system LSI10.

When the system LSI10in accordance with the embodiment reads out data through the JTAG port20, the system LSI10handles the input state of the predetermined general-purpose port as a predetermined pattern at the start of supplying the system LSI10with the power for driving.

When the power for driving starts being supplied to the system LSI10, the key detector36switches the key pattern enable signal S19to its assert state.

When the terminal pattern detector38starts being supplied with the power for driving, the pattern detector38reads out the pattern input terminal signal S12to compare the input state of the general-purpose port represented by the pattern input terminal signal S12with the predetermined pattern stored. As a result of the comparing, if the input state and the predetermined pattern are matched with each other, then the terminal pattern enable signal S8is switched to its assert state, whereas, otherwise, the terminal pattern enable signal S8is switched to its negate state. When the terminal pattern enable signal S8turns to its negate state, the JTAG port20becomes disabled because the enable signal S20outputted from the AND gate40turns to its negate state.

That prevents a user who does not know the pattern of the predetermined general-purpose port to enable the JTAG port20from accessing the inside of the system LSI10.

When the JTAG port20is enabled, the personal computer14outputs a read command for directing the host interface50to read out once data from the memory34.

In the ICE12, the command generator52interprets a command inputted from the host interface50, generates the JTAG signals for performing the command, and outputs the JTAG signals in order. The ICE12in accordance with the embodiment also outputs the JTAG command, e.g. as shown inFIG. 2in the order a JTAG shift command C11, a JTAG run command C12, a JTAG capture command C13, and a JTAG shift command C14, so as to read out data from the memory34once. The ICE12outputs the TMS signal106representing the JTAG shift command C11, and attaches the password data representing the password stored in the key data memory54to the end of the data representing the read command to the CPU32to output the TDI signal102.

In the TAP controller24, when the TMS signal106representing the JTAG shift command C11is inputted through the input/output tri-state circuit22, the TDI signal102inputted through the tri-state input/output circuit22is outputted as the inside TDI signal S1, and the debug control signal S16representing “shift” in sync with outputting the inside TDI signal S1the same number of times as the flip-flop circuits included in the key data cell26and the input data cell28.

Thus, data represented by the inside TDI signal S1is shifted to the key data cell26and the input data cell28in order.

After the shifting is finished, each flip-flop circuit in the key data cell26latches data representing the password, and each flip-flop circuit in the input data cell28latches data representing the read command to the CPU32.

Next, the ICE12outputs the TMS signal106representing the JTAG run command C12.

In the TAP controller24, when the TMS signal106representing the JTAG run command C12is inputted through the input/output tri-state circuit22, the debug control signal S16representing “run” is outputted.

Thus, data latched by each flip-flop circuit in the input data cell28is outputted as the debug input signal S14to the CPU32, and data latched by each flip-flop circuit in the key data cell26is outputted as the key data signal S17to the key detector36.

The CPU32interprets a command represented by data inputted from the input data cell28, reads out data from the memory34depending upon a result of the interpreting, and outputs the read out data as the debug output signal S13.

The key detector36compares the password represented by the key data signal S17with the preliminarily stored proper password, e.g. at the timing of t112as shown inFIG. 2, and switches the key pattern enable signal S19to its negate state when the passwords do not match each other.

Thus, when the passwords do not match each other, the key pattern enable signal S19outputted from the key detector36turns to its negate state. As a result, the input/output tri-state circuit22becomes disabled to cut off the JTAG port20because the enable signal S20outputted from the AND gate40turns to its negate state.

Once the key pattern enable signal S19outputted from the key detector36is switched to its negate state, the signal S19holds its negate state until the system LSI10is powered off. Therefore, subsequent data of the JTAG signals from the ICE12is not transferred to the inside of the system LSI10, the TDO signal110turns to its high-impedance state, and the inside TDO signal S2cannot be outputted.

When the key data signal S17matches the predetermined proper password stored, the enable signal S20outputted from the AND gate40holds its assert state because the key pattern enable signal S19holds its assert state.

Next, the ICE12outputs the TMS signal106representing the JTAG capture command C13.

In the TAP controller24, when the TMS signal106representing the JTAG capture command C13is inputted through the input/output tri-state circuit22, the debug control signal S16representing “capture” is outputted.

Thus, the output data cell30latches the debug output signal S13.

Next, the ICE12outputs the TMS signal106representing the JTAG shift command C14.

In the TAP controller24, when the TMS signal106representing the JTAG shift command C14is inputted through the input/output tri-state circuit22, the debug control signal S16representing “shift” is outputted the same number of times as the flip-flop circuits included in the output data cell30.

Thus, data latched by each flip-flop circuit in the output data cell30is outputted on one hand as the inside TDO signal S2to the TAP controller24, and outputted on the other hand as the TDO signal110to the ICE12through the TAP controller24.

The ICE12outputs the TDO signal110to the personal computer14in the form of host interface signal S11.

As stated above, in the system LSI10according to the embodiment, the command information representing the command and the password information representing the password are integrally inputted to the JTAG port20. The CPU32performs processing in response to the command represented by command information to produce the consequence information as a performance consequence. When the password represented by inputted password information does not match the predetermined proper password, the input/output tri-state circuit22cuts off transferring the command information to the CPU32and transferring the consequence information to the JTAG port20. The system LSI10can therefore heighten advantageously its security effect.

FIG. 3Ashows the system LSI10and the ICE12of an alternative embodiment of the present invention. In the following description, like components or constituent elements are designated with the same reference numerals and the repetitive descriptions will be omitted.

With reference toFIG. 3Balso, the system LSI10in accordance with the alternative embodiment further includes a one-time password generator42for LSI.

The one-time password generator42for LSI stores a first cipher value, and performs a predetermined arithmetical operation on the first cipher value to produce a password. The one-time password generator42is connected to the TAP controller24to receive the debug control signal S16, and updates, when the debug control signal S16representing “run” is inputted, the first cipher value to generate a new password. The generated password is outputted to the key detector36as a password signal S21.

The key detector36in accordance with the alternative embodiment compares, when the inputted debug control signal S16represents “run”, the password represented by the key data signal S17with the password represented by the password signal S21, and switches the key pattern enable signal S19to its negate state in case the passwords do not match each other.

Correspondingly, the ICE12in accordance with the alternative embodiment further includes a one-time password generator58for ICE, as shown inFIG. 3A.

The one-time password generator58for ICE stores a second cipher value, and performs a predetermined arithmetical operation on the second cipher value to produce a password. The one-time password generator58updates, when a run occurrence signal S20is inputted, the second cipher value to generate a new password.

In accordance with the alternative embodiment, the command generator52outputs, when outputting the JTAG command representing “run”, the run occurrence signal S20to the one-time password generator58for ICE.

In the one-time password generator42for LSI and the one-time password generator58for ICE in accordance with the alternative embodiment, the first and second cipher values, respectively, are initially set to one and the same predetermined value as the default values thereof. In addition, in the one-time password generators42and58, the predetermined arithmetical operations to be performed to update the first and second cipher values, respectively, are the same as each other. In the one-time password generators42and58, the predetermined arithmetical operations to be performed to generate the passwords from the first and second cipher values, respectively, are also the same as each other.

Next, the operation of the system LSI10in accordance with the alternative embodiment will be described. The following will be described to take an exemplified case where the personal computer14reads out twice data stored in the memory34provided for the system LSI10.

In the same manner as stated above with reference toFIGS. 1A and 1B, when the system LSI10in accordance with the alternative embodiment reads out data through the JTAG port20, the system LSI10handles the input state for the predetermined general-purpose port as the predetermined pattern and enables the JTAG port20at the start of supplying the power for driving with the system LSI10.

When the JTAG port20is enabled, the personal computer14outputs a read command to the host interface50to direct twice reading out data from the memory34.

In the ICE12, the command generator52interprets the command inputted from the host interface50, generates the JTAG signals for performing the command, and outputs the JTAG signals in order. The ICE12in accordance with the alternative embodiment also outputs the JTAG command, e.g. as shown inFIG. 4in the order the JTAG shift command C21(first read), the JTAG run command C22(first read), the JTAG capture command C23(first read), the JTAG shift command C24(first read/second read), the JTAG run command C25(second read) r the JTAG capture command C26(second read), the JTAG shift command C27(second read), so as to read out data twice from the memory34. The one-time password generator58for ICE outputs a password signal S22representing a password A generated on the basis of the first cipher value to the command generator52.

The ICE12outputs the TMS signal106representing the JTAG shift command C21, and attaches the password data A represented by the password signal S22to the end of the data representing the read command to the CPU32to output the TDI signal102, refer to P1inFIG. 4.

The TAP controller24, when receiving the TMS signal106representing the JTAG shift command C21through the input/output tri-state circuit22, as stated above, outputs the TDI signal102as the inside TDI signal SI, outputs the debug control signal S16representing “shift” the same number of times as the flip-flop circuits in the key data cell26and the input data cell28, and shifts the data represented by the inside TDI signal S1to the key data cell26and the input data cell28.

Thus, each flip-flop circuit in the key data cell26latches data representing the password A, and each flip-flop circuit in the input data cell28latches data representing the read command to the CPU32.

Next, the ICE12outputs the TM signal106representing the JTAG run command C22. At that moment, the one-time password generator58for ICE receives the run occurrence signal S20from the command generator52to update the first cipher value, and outputs the password signal S22representing a new password B to the command generator52. That is, the run command triggers an update of the password, refer to P2inFIG. 4. The password data B represented by the password signal S22is attached to the TDI signal102to output when the JTAG shift command C24is handled as described below, refer to P3inFIG. 4.

The TAP controller24, when the TMS signal106representing the JTAG run command C22is inputted through the input/output tri-state circuit22, outputs the debug control signal S16representing “run”.

Thus, the data latched by each flip-flop circuit in the input data cell28is outputted as the debug input signal S14to the CPU32, and the data latched by each flip-flop circuit in the key data cell26is outputted as the key data signal S17to the key detector36.

The CPU32interprets the command represented by the data inputted from the input data cell28, reads out the data from the memory34depending upon a result of the interpreting, and outputs the read out data as the debug output signal S13.

Also, the one-time password generator42for LSI outputs the password signal S21representing a password A′ generated on the basis of the second cipher value to the key detector36.

The key detector36compares the password A represented by the key data signal S17with the password A′ represented by the password signal S21, reflects the comparison result to the key pattern enable signal S19, and herein switches, when the passwords do not match each other, the key pattern enable signal S19to its negate state, refer to P4inFIG. 4.

Thus, when the passwords do not match each other, the key pattern enable signal519outputted from the key detector36turns to its negate state, and as a result, the input/output tri-state circuit22is disabled to cut off the JTAG port20because the enable signal S20outputted from the AND gate40turns to its negate state.

By contrast, when the passwords match each other, the enable signal S20outputted from the AND gate40holds its assert state because the key pattern enable signal S19holds its assert state.

In addition, the one-time password generator42for LSI receives the debug control signal516representing “run” to update the second cipher value, and outputs the password signal S21representing the new password B′ to the key detector36. That is, the run command triggers the update of the password, refer to P5inFIG. 4.

Next, the ICE12outputs the TMS signal106representing the JTAG capture command C23.

The TAP controller24outputs, when the TMS signal106representing the JTAG capture command C23is inputted through the input/output tri-state circuit22, the debug control signal S16representing “capture”.

Thus, the output data cell30latches the debug output signal S13.

Next, the ICE12outputs the TMS signal106representing the JTAG shift command C24, and attaches the password data B represented by the password signal S22to the end of the data representing the second read command to the CPU32to output the TDI signal102. That is, the run command triggers the update of the password, refer to P3inFIG. 4.

The TAP controller24, when the TMS signal106representing the JTAG shift command C24is inputted through the input/output tri-state circuit22, outputs the TDI signal102inputted through the input/output tri-state circuit22as the inside TDI signal S1in order, and the debug control signal S16representing “shift” in sync with outputting the inside TDI signal S1the same number of times as the flip-flop circuits in the key data cell26and the input data cell28.

Thus, the data latched by each flip-flop circuit in the output data cell30is outputted as the inside TDO signal S2to the TAP controller24, and outputted as the TDO signal110to the ICE12through the TAP controller24.

At the same time, each flip-flop circuit in the key data cell26latches the data representing the password B, and each flip-flop circuit in the input data cell28latches data representing the second read command to the CPU32.

Next, the ICE12outputs the TMS signal106representing the JTAG run command C25.

The TAP controller24outputs, when the TMS signal106representing the JTAG run command C25is inputted through the input/output tri-state circuit22, the debug control signal S16representing “run”.

Thus, the data latched by each flip-flop circuit in the input data cell28is outputted as the debug input signal S14to the CPU32, and the data latched by each flip-flop circuit in the key data cell26is outputted as the key data signal S17to the key detector36.

The CPU32interprets the command represented by data inputted from the input data cell28, reads out the data from the memory34depending upon a result of the interpreting, and outputs the read out data as the debug output signal S13.

Also, the key detector36compares the password B represented by the key data signal S17with the password B′ represented by the password signal S21, reflects the comparison result to the key pattern enable signal S19, and herein switches, when the passwords do not match each other, the key pattern enable signal S19to its negate state, refer to P6inFIG. 4.

At that moment, the password B′ represented by the password signal S21is the password updated according to the first readout as stated above, and the key data signal S17is the password B updated according to the first readout as stated above. Therefore, the password represented by the key data signal S17and the password represented by the password signal S21match each other, the key pattern enable signal S19is kept its assert state, and as a result, the enable signal S20is kept the assert state.

Now, if the password represented by the key data signal S17and the password represented by the password signal S21do not match each other, the key pattern enable signal S19turns to its negate state, and as a result, the input/output tri-state circuit22is disabled to cut off the JTAG port20because the enable signal S20outputted from the AND gate40turns to its negate state.

The one-time password generator42for LSI receives the debug control signal S16representing “run” to update the second cipher value, and outputs the password signal S21representing a new password C′ to the key detector36. That is, the run command triggers the update of the password, refer to P7inFIG. 4.

Next, the ICE12outputs the TMS signal106representing the JTAG capture command C26.

The TAP controller24outputs, when the TMS signal106representing the JTAG capture command C26is inputted through the input/output tri-state circuit22, the debug control signal S16representing “capture”.

Thus, the output data cell30latches the debug output signal S13.

Next, the ICE12outputs the TMS signal106representing the JTAG shift command C27.

The TAP controller24, when the TMS signal106representing the JTAG shift command C27is inputted through the input/output tri-state circuit22, outputs the debug control signal S16representing “shift” the same number of times as the flip-flop circuits in the output data cell30.

Thus, the data latched by each flip-flop circuit in the output data cell30is outputted as the inside TDO signal S2to the TAP controller24, and outputted as the TDO signal110to the ICE12through the TAP controller24.

As stated above, the system LSI10and the ICE12of the alternative embodiment can thus heighten advantageously its security effect because the password is updated every time the run command is performed.

Both of the illustrative embodiments stated above have the input/output tri-state circuit22adapted to cut off all of the JTAG signals, but the present invention is not to be restricted by the specific embodiments. The system may be structured such that only some of the signals are cut off, or, for example, only one of the TDI signal102and the TDO signal110are cut off. Such cases have the same advantages as the illustrative embodiments as well.

In addition, the illustrative embodiments stated above is adapted to attach the password data to the end of data representing the read command, but the present invention is not to be restricted by the specific embodiments. For example, password data may be attached to any position as long as it is integrated. In this case, data may be extracted from a portion corresponding to the password data for comparison, depending upon the extracting position. This case has also the same advantages as the illustrative embodiments as well.

The illustrative embodiments stated above have the input/output tri-state circuit22adapted to cut off the JTAG signals, but the present invention is not to be restricted by the specific embodiments. For example, the TAP controller24maybe disabled to cutoff the transfer. This case also attains the same advantages as the illustrative embodiments as well.

In addition, the alternative embodiment stated above has passwords generated on the basis of the same value stored in the one-time password generator42for LSI and the one-time password generator58for ICE, but the present invention is not to be restricted by the specific embodiment. For example, a circuit holding the time may be provided for each of the one-time password generators42and58to synchronize the time with each other, and passwords may be generated on the basis of the time. This case also has the same advantages as the illustrative embodiments as well.

The configuration of the system LSI10and the ICE12described with reference toFIGS. 1A,1B,3A and3B of the illustrative embodiments is only illustrative. The system LSI10and the ICE12may be configured suitably so far as not deviating from the spirit and scope of the prevent invention.

The format of the JTAG command described with reference toFIGS. 2 and 4is only illustrative. The JTAG command may be arranged suitably so far as not deviating from the spirit and scope of the prevent invention.

The entire disclosure of Japanese patent application No. 2006-355089 filed on Dec. 28, 2006, including the specification, claims, accompanying drawings and abstract of the disclosure, is incorporated herein by reference in its entirety.

While the present invention has been described with reference to the particular illustrative embodiments, it is not to be restricted by the embodiments. It is to be appreciated that those skilled in the art can change or modify the embodiments without departing from the scope and spirit of the present invention.