## 4 JTAG Security Solutions
### Exploitation Using Statistical Machine Learning  
[PERSON] et al. [33] (2015) conducted an experiment to detect unauthorized access through JTAG port. The authors proposed statistical learning in chip (SLIC-J) scheme for JTAG protection. They proposed this scheme by assuming illegitimate person will act differently compared with authorized person. In this, the authors simulated results using openSPARC T2 benchmark. Basically, JTAG functions such as direct memory observe, clock control, internal scan, shadow scan, L2 cache scan, etc. are stored inside instruction register, which can be vulnerable with respect to attackers. Authors described JTAG attacking strategies in three main steps: (1) identifying the JTAG port on chip/PCB board; (2) finding basic profile of data register (DR) that can be used to extract or write the data; and (3) investigating the undocumented functions. Table 1 explains the main steps and their sub-steps. Figure 4: Secure JTAG architecture [31]. To perform these steps, the authors used a two-phase scheme, i.e., offline learning and online prediction. Offline learning is used to train decision tree classifier, which is stored in nonvolatile memory, whereas feature extraction and supplying those features to the decision tree is done in online prediction. There are basically eight type of features that are explained in the paper: higher and lower 4 bits of JTAG instruction, number of clock cycles in shift-DR, run-test/idle, test-logic-reset, number of test-mode-select (TMS) transitions, type of transition, and legal opcode. These features are kept in a look-up table (LUT) and fed to decision-tree classifier. The classifier must have enough datasets for illegitimate user detection such that SLIC-J is the preferred _\"normal_transition\"_.  
\[0<=Tl<=Th<=k \tag{1}\]  
where \(k\) is instructions, \(m\) is number of illegitimate predictions within a period, and \(Tl\) and \(Th\) are two thresholds. 1. If \(m=k\), then the user is considered as an attacker. 2. If\(Th\leq m\leq k\), then the user is most likely be an attacker. 3. If \(Tl\leq m\leq Th\), then the user may or may not be an attacker. 4. If \(M<+Tl\), then the user is considered as legitimate. The goal of this paper is to discover undocumented JTAG functions that can be used to hack chip. In addition, the same authors implemented another two-layered approach to secure JTAG attacks based on machine learning methods [35]. In this experiment, results are compared with other previously published protection schemes such as encryption, signature detection, anomaly detection, and SLIC-J statistical learning [33] and showed overall 94% accuracy. They proposed protection scheme to secure the system from unknown attacks. As we know, if one wants to add security measures in the existing IEEE 1149.1, then there are primarily two measures considered: (1) the level of security that is enhanced; and (2) the overall overhead that is added on the existing system. Thus, this experiment ensures high level security with a medium level of extra overhead. The study proposes a two-layered approach, where the violation of basic rules of JTAG operation are in the first layer. The second layer allows those who were successfully examined by first layer, in which Support Vector Machine (SVM) based classification is performed. The main motivation behind the implementation of the first layer is to label attackers immediately if one uses illegal opcodes and/or invokes incorrect length of read/write data. This behavior can only be observed in unauthorized users who have little or no knowledge of IC internals and its JTAG operation. In the second layer, behavioral pattern of the user is validated by considering the sequential order of JTAG instructions. Usually, there are multiple different operations with different JTAG instructions, which mostly have different opcode lengths. Thus, this shows nonlinear boundaries and overlapping regions while classifying between legitimate users and illegitimate users.