A Joint Test Action Group, JTAG, debug apparatus, configured to debug a to-be-debugged unit in a chip, wherein the JTAG debug apparatus comprises: a Test Access Port, TAP, controller, configured to communicate with outside by using an external JTAG port, and generate, based on a signal received from the JTAG port, a debug signal comprising an address of the to-be-debugged unit and a debug instruction, wherein the debug signal is a JTAG port signal based on the JTAG protocol; a signal conversion unit, configured to receive the debug signal that is output from the TAP controller, and convert the debug signal from the JTAG port signal to a bus slave port signal that can access a slave port of the to-be-debugged unit; and a bus, configured to obtain the debug signal that is converted to the bus slave port signal and that is output from the signal conversion unit, and transmit, based on the debug signal, the debug instruction to the to-be-debugged unit indicated by the address of the to-be-debugged unit; said JTAG debug apparatus is characterised by further comprising a non-volatile memory, a loading unit, and a security logic processing unit, wherein the non-volatile memory stores security configuration information; the loading unit automatically loads the security configuration information stored in the non-volatile memory to the security logic processing unit when the chip is powered on; and the security logic processing unit outputs an enable signal based on the loaded security configuration information, so as to control whether access to the to-be-debugged unit from the JTAG port by using the TAP controller and the signal conversion unit is allowed. a Test Access Port, TAP, controller, configured to communicate with outside by using an external JTAG port, and generate, based on a signal received from the JTAG port, a debug signal comprising an address of the to-be-debugged unit and a debug instruction, wherein the debug signal is a JTAG port signal based on the JTAG protocol; a signal conversion unit, configured to receive the debug signal that is output from the TAP controller, and convert the debug signal from the JTAG port signal to a bus slave port signal that can access a slave port of the to-be-debugged unit; and a bus, configured to obtain the debug signal that is converted to the bus slave port signal and that is output from the signal conversion unit, and transmit, based on the debug signal, the debug instruction to the to-be-debugged unit indicated by the address of the to-be-debugged unit; said JTAG debug apparatus is characterised by further comprising a non-volatile memory, a loading unit, and a security logic processing unit, wherein the non-volatile memory stores security configuration information; the loading unit automatically loads the security configuration information stored in the non-volatile memory to the security logic processing unit when the chip is powered on; and the security logic processing unit outputs an enable signal based on the loaded security configuration information, so as to control whether access to the to-be-debugged unit from the JTAG port by using the TAP controller and the signal conversion unit is allowed.