# Preventing Scan-Based Side-Channel Attacks by Scan Obfuscating with a Configurable Shift Register

Authors: Weizheng Wang; Yin Chen; Shuo Cai; Yan Peng
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Scan test is widely used in integrated circuit test. However, the excellent observability and controllability provided by the scan test gives attackers an opportunity to obtain sensitive information by using scan design to threaten circuit security. Hence, the primary motivation of this paper is to improve the existing DFT technique, i.e., to enhance the chip security on the premise of guaranteeing test quality. In this paper, we propose a new scan design method against scan-based side-channel attack. In the proposed method, the encryption structure is adopted, which requires the correct test authorization code to carry out normal test operation. Without the correct test authorization, the attackers cannot obtain the desired scan data, preventing the scan-based side-channel attacks. Furthermore, the test authorization code is determined by the nonvolatile memory built into the chip to realize the inconsistency of the test authorization code for each chip.


---

## Body

## 1. Introduction

In recent years, several technologies, such as sensor networks [1–4], wireless communication [5–8], smart grid [9, 10], big data [11, 12], and internet of things [13, 14], have been developed rapidly and their security has been widely researched [15]. At the same time, the researcher has been paying more and more attention to the security issue of the underlying hardware [16–18].In the manufacturing process of integrated circuit, defects are inevitable. When system intrinsic faults and faults in the integrated circuit occur simultaneously [19–21], fault detection will become more difficult [22–24]. In order to detect the faults of integrated circuit, testing is becoming an indispensable step and occupies an important position. Based on this, the design of scan chain to facilitate testing is proposed and widely used. Scan chain design can provide high controllability and observability during testing. However, the design of the scan chain gives attackers an open door while providing convenience. In [25], Yang et al. first proposed the scan-based side-channel attack. If the scan chain is not encrypted, sensitive information such as intellectual property (IP) or secret keys [26, 27] could be exposed to attackers. Therefore, it is necessary to use a feasible solution to protect integrated circuits (ICs) from scan-based side-channel attacks [28].In recent years, many scan-based attacks have been proposed to protect encryption systems. The scan-based side-channel attacks are mainly carried out through the acquisition and analysis of scan data. Currently, on-chip implementation of private key algorithms have been facing scan-based side-channel attacks, like Data Encryption Standard (DES) [29], Advanced Encryption Standard (AES) [30], Rivest-Shamire-Adleman (RSA) [31], Elliptic Curve Cryptography (ECC) [32], NtrueTrypt [33], and Stream Cryptography based on Linear Feedback Shift Register (LFSR) [34].Based on this, many countermeasures are put forward to counter the scan-based attacks [35–44]. Previously, the existing advanced DFT architecture includes test response compactor, X-masker [45, 46], and X-tolerance [47, 48]. They were regarded as a powerful countermeasure of resisting scan-based attacks. This DFT architecture makes it difficult to apply plaintext input and obtain intermediate data from the scan chain, which provides a high level of security. However, recent research has shown that this strategy is also vulnerable. After inserting the test controller into the circuit under test, the state of the scan chain is cleared if the CUT is switched from functional mode to test mode [49]. This countermeasure is effective against mode-switching attacks, but they are not available against test-mode-only attacks. In [50], the technique keeps the password apart from the key module in test mode. It prevents an attacker from switching between test mode and functional mode. Another kind of methods obfuscate the scan output by changing the structure of the scan chain [51–56]. However, even without information about the scan cells, a skilled adversary can still carry out a signature attack [57, 58]. In [59], a solution is proposed, which is based on the lock and key of physical unclonable function, but this design method has a particularly high hardware overhead. Some methods resist scan-based attacks by reordering scan chains [60–69].In order to protect the encryption chip from scan-based side-channel attacks, in this paper, we propose a new scan design method. In this method, only the user with the correct test authorization code can perform a normal scan. When a user without test authorization code tries to perform a scan test, the scan input/output data will be obfuscated. The test authorization code is determined by the values of the nonvolatile memory and the way theD flip-flops in a nonlinear shift register (NSR) connect with scan flip-flops. This means that the test authorization code for each encryption chip can be set differently. The main contributions of this paper are as follows:(1)
A novel scan design scheme based on test authorization is presented to overcome scan attacks. By embedding a small management circuit, the enhanced DFT scheme improves significantly the security of chip. Furthermore, the proposed scheme does not incur significant performance penalties, for example, without decreasing the testability of the chip and increasing any timing delay.(2)
The test authorization code can be changed when altering the configuration bits for the nonlinear shift register. Hence, the test authorization code can be different for two chips with the same design. This reduces substantially the risk of test authorization code disclosure. Even if one test authorization code is leaked, it will not affect all chips.The rest of this paper is organized as follows. Section2 describes the basic ideas, scan structure, and timing analysis of the proposed structure. Section 3 provides testability analysis, security analysis, and experimental results. Section 4 is the conclusion of this paper.


## 2. Proposed Secure Scan Design

### 2.1. Basic Idea of Proposed Secure Scan Design

In the proposed secure scan design, the test authorization code is used to manage scan operation. Only entering the correct test authorization code can enable the normal scan operation. When the test authorization code is wrong, the scan-in stimulus and scan-out response are randomly XORed with the value of the node inside the combinational logic unit. At the same time, the wrong key will cyclically shift in the NSR, making data obfuscation elusory. Since the scan data is obfuscated, attackers will be misled into inferring incorrect results.After power-on, the circuit is reset first. The operation mode of the circuit is controlled by the shift enable signalSE. When SE is set to low (“0”), the circuit enters in functional mode. When SE changes from “0” to “1,” enter the test authorization code from the first clock cycle of the scan test, and the N-bit test authorization code should be entered in N clock cycles. If the test authorization code is correct, normal scan operations can be carried out and the scan data will not be affected. If not, the circuit cannot perform the normal scan operation and the scan data will be obfuscated. The attacker will mistakenly believe that is the correct scan data and infer incorrect results. In order to strengthen the security of the encryption chip, the nonvolatile memory is used to control the test authorization code of each chip to be different. The test authorization code is determined by both the values of the nonvolatile memory and the output port (Q or Q¯) of the D flip-flops in the NSR used to control the scan chain.The proposed scan design method is a new architecture. In the following introduction, we first introduce the secure scan design and then show how to perform the test operation on a protected chip.


### 2.2. Scan Architecture of Proposed Secure Scan Design

As shown in Figure1, the proposed secure scan structure is mainly composed of nonvolatile memory, nonlinear shift register (NSR), scan chain, and some control logic. The scan chain, made up of scan flip-flops (SFFs) marked in blue, is the intrinsic component in the standard scan design. The configurable NSR is used to store the test authorization code. If the test authorization code is N bits, an N-bit vector is needed to prestore in the nonvolatile memory to configure the NSR. The NSR contains N D flip-flops, each of which is preceded by a 2-to-1 Multiplexer. The multiplexer has two data inputs, which are connected with the output Q and Q¯ of the front D flip-flop, respectively. The address input driven by a configuration bit in the nonvolatile memory is used to determine which data input is selected. Therefore, if the bit in the nonvolatile memory is “0,” it indicates that the output Q¯ of the front D flip-flop derives the next D flip-flop. Instead, if the bit is “1,” it implies the output Q of the front D flip-flop derives the next D flip-flop. It should be pointed out that the D input to the first D flip-flop is controlled by an additional 2-to-1 multiplexer. The two data inputs of the multiplexer are, respectively, connected to the last D flip-flop and the test authorization code input pin.Figure 1
Proposed secure scan structure.In the proposed structure, the scan chain is modified; that is, some XNOR gates are inserted between scan flip-flops. The output of a NAND gate serves as one of the inputs to the XNOR gate between scan flip-flops. The outputQ (or its complement Q¯) of a D flip-flop in NSR is connected with one input of the NAND gate, and the other input is driven by a combinational logic node selected randomly from CUT. On the assumption of Q connection, if the output Q of a NSR cell is 0, the NAND gate generates “1,” and the output of the XNOR gate is decided by the preceding scan flip-flop. Otherwise, if the output Q of a NSR cell is “1,” the output of the NAND gate is decided by the combinational logic node. When the combinational logic node is also “1,” the low level output of the NAND gate will make the succeeding scan flip-flop receive the opposite value of the preceding scan flip-flop. By this way, the logic obfuscation in the scan chain is achieved. Due to the uncertainty about the value of the combinational logic node, the logic obfuscation is haphazard and thus difficult to analyze. It is not difficult to see that if the Q output of a NSR cell is used to hardwire to the NAND gate, to enable the normal scan operation the state of the NSR cell should be 0. On the contrary, if it is the complement output Q¯, the state of the NSR cell should be 1. We define the expected NSR state enabling the normal scan operation as the scan key. Meanwhile, the vector, which is loaded into NSR and used to generate the scan key, is defined as the test authorization code.Besides being connected to the NAND gate, theQ output (or its complement Q¯) of each NSR cell is also connected with an OR gate GT2. After the test authorization code is entered into the NSR completely, the output of the OR gate G2 can be latched into the D flip-flop DF1. The clock signal clk_0 of DF1 is driven by the OR gate GT3, which is controlled by the system clock CLK. The other input of GT3 is connected to the carry output Cout of a module-N counter CT1. The clock signal clk_1 of the D flip-flop in NSR is driven by the output Q1 of DF1 and the system clock CLK through the AND gate GT1. The enable signal of CT1 is marked as EN, which is connected to the complement of the carry output signal cout through an AND gate GT4.After the system reset or power-on, the module-N counter CT1 and DF1 will be initialized to zeros. The NSR is also initialized to all-zeros state.In the test mode (SE = 1), when the output of the AND gate GT4 is high-level, EN port becomes high, and the module-N counter will be enabled. The module-N counter will start counting from zero. During this mode, test authorization code should be delivered first. When the correct test authorization code is entered completely, all the inputs of OR gate GT2 are “1” and the output of OR gate GT2 is “0,” so clk_1 will be “0.” Simultaneously, the counter reaches the maximum value of counting, so the carry output signal of CT1 becomes “1.” Due to the “1” value of carry output signal, the EN input of CT1 turns low, leading CT1 into the hold mode. The D flip-flop DF1 is locked because clk_0 is equal to “1” consistently. During this period, Q1 = 0 and the output signal clk_1 of GT1 remains “0.” At this time, the D flip-flop in the NSR is locked by the clock clk_1 and the correct test authorization code is stored in the NSR until it is initialized. Because one input of the XNOR gate between SFFs is “1,” the scan data will not be affected and normal scan operations can be performed.When the test authorization code is incorrect, that is, at least one bit is incorrect, the scan key will also be wrong. In this case, the output of the OR gate GT2 will be “1” after the module-N counter reaches the maximum value of counting. The “1” output of GT2 will be latched into DF1, the clock clk_0 of DF1 is disabled, and Q1 remains “1.” Thus, the output clock clk_1 of GT1 will be active; that is, the shift operation in the NSR is enabled. The incorrect scan key will be shifted cyclically in NSR during the execution of the test operation. The shifted scan key will obfuscate the output of the scan chain through the XOR gate between SFFs. As a result, the attacker gets incorrect scan output, making the scan attack invalid.As mentioned earlier, the test authorization code is determined by the combination of the values in the nonvolatile memory and the connection style between NSR and the scan chain. The following is an example of inferring the test authorization code. Take a 5-bit test authorization code as an example. Assume that the value in nonvolatile memory is 01101, and the initial state in NSR after initialization is 00000. The test authorization codeX5, X4, X3, X2, X1 is delivered in five clock cycle from right to left. As can be seen from Table 1, after one cycle, the state of NSR becomes X11001. Eventually, after five cycles, the state of NSR is X5, X4¯, X3¯, X2¯, X1. The connection style between the D flip-flops in the NSR and the inserted NAND gates is shown in Figure 2. Thus, the expected scan key should be 11001. That is, X5, X4¯, X3¯, X2¯, X1 should be consistent with 11001. The right test authorization code can be solved, i.e., X5, X4, X3, X2, X1 = 10111.Table 1
The state of example NSR.
0th000001stX110012ndX2X1¯1013rdX3X2¯X1¯114thX4X3¯X2¯X1¯05thX5X4¯X3¯X2¯X111001Figure 2
An example of inferring test authorization code.


### 2.3. Timing Analysis of Proposed Secure Scan Design

Assume that the state of the circuit before reset is unknown. The circuit is reset when the reset signalRST of the circuit changes from low to high. That is, all storage units are cleared to zero. In functional mode, RST is invalid and SE is low. In functional mode, NSR will not affect any operation of the circuit. Because the clk_1 is low, the NSR is disabled and the initial value of the NSR will not change. Low-level SE causes EN to be low. Based on this, the counter CT1 will not start counting, and the carry signal cout remains “0.” In summary, additional circuits will not work in functional mode.In order to perform the test operation,SE should be set to “1,” while clk_1 is activated. The N-bit test authorization code can be entered serially into the NSR input port. At this point, the EN port of CT1 is activated and the counter starts counting from “00.” When the test authorization code is completely entered, the carry signal cout of CT1 turns “1.” The high value of cout makes the enable signal EN of CT1 turn to “0,” causing CT1 to be disabled. As described in Section 3, if the incorrect test authorization code is entered, the output Q1 of DF1 will be high due to the high output of GT2. The clock signal clk_1 of NSR is always consistent with CLK during test mode. The timing diagrams are illustrated in Figure 3. In this condition, incorrect test authorization code will shift bit by bit in the D flip-flop of NSR. That is, the scan data is the obfuscated data instead of the output data under scan test with correct test authorization code.Figure 3
Timing diagram when the test authorization code is incorrect.If the test authorization code entered is correct, the input of DF1 connected to the output of GT2 will be low. Because one input of GT1 is “0,” the clock signalclk_1 of the D flip-flop in the NSR will be disabled, and the correct test authorization code is stored in the NSR. The timing diagrams are illustrated in Figure 4. In this condition, the scan test can be implemented normally.Figure 4
Timing diagram when the test authorization code is correct.


## 2.1. Basic Idea of Proposed Secure Scan Design

In the proposed secure scan design, the test authorization code is used to manage scan operation. Only entering the correct test authorization code can enable the normal scan operation. When the test authorization code is wrong, the scan-in stimulus and scan-out response are randomly XORed with the value of the node inside the combinational logic unit. At the same time, the wrong key will cyclically shift in the NSR, making data obfuscation elusory. Since the scan data is obfuscated, attackers will be misled into inferring incorrect results.After power-on, the circuit is reset first. The operation mode of the circuit is controlled by the shift enable signalSE. When SE is set to low (“0”), the circuit enters in functional mode. When SE changes from “0” to “1,” enter the test authorization code from the first clock cycle of the scan test, and the N-bit test authorization code should be entered in N clock cycles. If the test authorization code is correct, normal scan operations can be carried out and the scan data will not be affected. If not, the circuit cannot perform the normal scan operation and the scan data will be obfuscated. The attacker will mistakenly believe that is the correct scan data and infer incorrect results. In order to strengthen the security of the encryption chip, the nonvolatile memory is used to control the test authorization code of each chip to be different. The test authorization code is determined by both the values of the nonvolatile memory and the output port (Q or Q¯) of the D flip-flops in the NSR used to control the scan chain.The proposed scan design method is a new architecture. In the following introduction, we first introduce the secure scan design and then show how to perform the test operation on a protected chip.


## 2.2. Scan Architecture of Proposed Secure Scan Design

As shown in Figure1, the proposed secure scan structure is mainly composed of nonvolatile memory, nonlinear shift register (NSR), scan chain, and some control logic. The scan chain, made up of scan flip-flops (SFFs) marked in blue, is the intrinsic component in the standard scan design. The configurable NSR is used to store the test authorization code. If the test authorization code is N bits, an N-bit vector is needed to prestore in the nonvolatile memory to configure the NSR. The NSR contains N D flip-flops, each of which is preceded by a 2-to-1 Multiplexer. The multiplexer has two data inputs, which are connected with the output Q and Q¯ of the front D flip-flop, respectively. The address input driven by a configuration bit in the nonvolatile memory is used to determine which data input is selected. Therefore, if the bit in the nonvolatile memory is “0,” it indicates that the output Q¯ of the front D flip-flop derives the next D flip-flop. Instead, if the bit is “1,” it implies the output Q of the front D flip-flop derives the next D flip-flop. It should be pointed out that the D input to the first D flip-flop is controlled by an additional 2-to-1 multiplexer. The two data inputs of the multiplexer are, respectively, connected to the last D flip-flop and the test authorization code input pin.Figure 1
Proposed secure scan structure.In the proposed structure, the scan chain is modified; that is, some XNOR gates are inserted between scan flip-flops. The output of a NAND gate serves as one of the inputs to the XNOR gate between scan flip-flops. The outputQ (or its complement Q¯) of a D flip-flop in NSR is connected with one input of the NAND gate, and the other input is driven by a combinational logic node selected randomly from CUT. On the assumption of Q connection, if the output Q of a NSR cell is 0, the NAND gate generates “1,” and the output of the XNOR gate is decided by the preceding scan flip-flop. Otherwise, if the output Q of a NSR cell is “1,” the output of the NAND gate is decided by the combinational logic node. When the combinational logic node is also “1,” the low level output of the NAND gate will make the succeeding scan flip-flop receive the opposite value of the preceding scan flip-flop. By this way, the logic obfuscation in the scan chain is achieved. Due to the uncertainty about the value of the combinational logic node, the logic obfuscation is haphazard and thus difficult to analyze. It is not difficult to see that if the Q output of a NSR cell is used to hardwire to the NAND gate, to enable the normal scan operation the state of the NSR cell should be 0. On the contrary, if it is the complement output Q¯, the state of the NSR cell should be 1. We define the expected NSR state enabling the normal scan operation as the scan key. Meanwhile, the vector, which is loaded into NSR and used to generate the scan key, is defined as the test authorization code.Besides being connected to the NAND gate, theQ output (or its complement Q¯) of each NSR cell is also connected with an OR gate GT2. After the test authorization code is entered into the NSR completely, the output of the OR gate G2 can be latched into the D flip-flop DF1. The clock signal clk_0 of DF1 is driven by the OR gate GT3, which is controlled by the system clock CLK. The other input of GT3 is connected to the carry output Cout of a module-N counter CT1. The clock signal clk_1 of the D flip-flop in NSR is driven by the output Q1 of DF1 and the system clock CLK through the AND gate GT1. The enable signal of CT1 is marked as EN, which is connected to the complement of the carry output signal cout through an AND gate GT4.After the system reset or power-on, the module-N counter CT1 and DF1 will be initialized to zeros. The NSR is also initialized to all-zeros state.In the test mode (SE = 1), when the output of the AND gate GT4 is high-level, EN port becomes high, and the module-N counter will be enabled. The module-N counter will start counting from zero. During this mode, test authorization code should be delivered first. When the correct test authorization code is entered completely, all the inputs of OR gate GT2 are “1” and the output of OR gate GT2 is “0,” so clk_1 will be “0.” Simultaneously, the counter reaches the maximum value of counting, so the carry output signal of CT1 becomes “1.” Due to the “1” value of carry output signal, the EN input of CT1 turns low, leading CT1 into the hold mode. The D flip-flop DF1 is locked because clk_0 is equal to “1” consistently. During this period, Q1 = 0 and the output signal clk_1 of GT1 remains “0.” At this time, the D flip-flop in the NSR is locked by the clock clk_1 and the correct test authorization code is stored in the NSR until it is initialized. Because one input of the XNOR gate between SFFs is “1,” the scan data will not be affected and normal scan operations can be performed.When the test authorization code is incorrect, that is, at least one bit is incorrect, the scan key will also be wrong. In this case, the output of the OR gate GT2 will be “1” after the module-N counter reaches the maximum value of counting. The “1” output of GT2 will be latched into DF1, the clock clk_0 of DF1 is disabled, and Q1 remains “1.” Thus, the output clock clk_1 of GT1 will be active; that is, the shift operation in the NSR is enabled. The incorrect scan key will be shifted cyclically in NSR during the execution of the test operation. The shifted scan key will obfuscate the output of the scan chain through the XOR gate between SFFs. As a result, the attacker gets incorrect scan output, making the scan attack invalid.As mentioned earlier, the test authorization code is determined by the combination of the values in the nonvolatile memory and the connection style between NSR and the scan chain. The following is an example of inferring the test authorization code. Take a 5-bit test authorization code as an example. Assume that the value in nonvolatile memory is 01101, and the initial state in NSR after initialization is 00000. The test authorization codeX5, X4, X3, X2, X1 is delivered in five clock cycle from right to left. As can be seen from Table 1, after one cycle, the state of NSR becomes X11001. Eventually, after five cycles, the state of NSR is X5, X4¯, X3¯, X2¯, X1. The connection style between the D flip-flops in the NSR and the inserted NAND gates is shown in Figure 2. Thus, the expected scan key should be 11001. That is, X5, X4¯, X3¯, X2¯, X1 should be consistent with 11001. The right test authorization code can be solved, i.e., X5, X4, X3, X2, X1 = 10111.Table 1
The state of example NSR.
0th000001stX110012ndX2X1¯1013rdX3X2¯X1¯114thX4X3¯X2¯X1¯05thX5X4¯X3¯X2¯X111001Figure 2
An example of inferring test authorization code.


## 2.3. Timing Analysis of Proposed Secure Scan Design

Assume that the state of the circuit before reset is unknown. The circuit is reset when the reset signalRST of the circuit changes from low to high. That is, all storage units are cleared to zero. In functional mode, RST is invalid and SE is low. In functional mode, NSR will not affect any operation of the circuit. Because the clk_1 is low, the NSR is disabled and the initial value of the NSR will not change. Low-level SE causes EN to be low. Based on this, the counter CT1 will not start counting, and the carry signal cout remains “0.” In summary, additional circuits will not work in functional mode.In order to perform the test operation,SE should be set to “1,” while clk_1 is activated. The N-bit test authorization code can be entered serially into the NSR input port. At this point, the EN port of CT1 is activated and the counter starts counting from “00.” When the test authorization code is completely entered, the carry signal cout of CT1 turns “1.” The high value of cout makes the enable signal EN of CT1 turn to “0,” causing CT1 to be disabled. As described in Section 3, if the incorrect test authorization code is entered, the output Q1 of DF1 will be high due to the high output of GT2. The clock signal clk_1 of NSR is always consistent with CLK during test mode. The timing diagrams are illustrated in Figure 3. In this condition, incorrect test authorization code will shift bit by bit in the D flip-flop of NSR. That is, the scan data is the obfuscated data instead of the output data under scan test with correct test authorization code.Figure 3
Timing diagram when the test authorization code is incorrect.If the test authorization code entered is correct, the input of DF1 connected to the output of GT2 will be low. Because one input of GT1 is “0,” the clock signalclk_1 of the D flip-flop in the NSR will be disabled, and the correct test authorization code is stored in the NSR. The timing diagrams are illustrated in Figure 4. In this condition, the scan test can be implemented normally.Figure 4
Timing diagram when the test authorization code is correct.


## 3. Results and Performance Analysis

### 3.1. Testability Analysis

The insertion of security design does not affect the original testability of the circuit. All commonly used testing techniques like stuck-at, and delay test can be applied. As long as the test authorization code is entered correctly, the normal scan operation can be performed, and the scan-out data will not be obfuscated.Targeting at the stuck-at fault model, we do experiments on several big ITC′99 benchmark circuits including B17, B18, B19, B20, and B22. The results show, the fault coverage does not reduce for all these benchmark circuits with the same test set when the proposed secure scan design is integrated into them.Since the added security design only adds logic gates, counters, and triggers, the faults occurring in the security scan design can be easily detected. When faults occur, although the test authorization code entered is correct, the output data will be still obfuscated. Then, the circuit will be treated as faulty one. Therefore, this does not affect the testability of the circuit.


### 3.2. Security Analysis

This section provides a detailed analysis of the security of the proposed structure by means of the following attack models.


#### 3.2.1. Brute Force Attack

Since the test authorization code of the circuit is determined by the values in the nonvolatile memory and the way the NSR is connected with the scan chain, it is difficult to guess the test authorization code by brute force without obtaining specific design information about the circuit. The probability of randomly speculating theL-bit test authorization code to perform the scan test correctly is 1/2L.For L = 64, the probability of guessing the test authorization code is only 5.4×10−20. In this case, it is impossible to obtain the test authorization code through brute force attack. In engineering applications, the attack probability and hardware overhead within the controllable range determine the value of L.


#### 3.2.2. Differential Attack

Differential attack means that the attacker first runs in functional mode for several cycles and then switches to test mode to obtain an intermediate state [32]. Even if the attacker can dominate the scan chain through the primary input pins, the output data of scan chain will be obfuscated without the correct test authorization code. Therefore, the proposed secure scan structure can resist differential attack.


#### 3.2.3. Test-Mode-Only Attack

Test-mode-only differential attack requires attackers to scan specific test vector pairs to obtain valuable information. However, in the proposed secure scan structure, these data will not be properly loaded into the scan chain due to the protection of obfuscation logic. In addition, incorrect keys can be cyclically shifted in the NSR during testing. Therefore, this leaves the obfuscated bits in an indeterminate state for each clock cycle while the scan operation is being performed. Therefore, the secure design proposed in this paper has the ability to resist test-mode-only attack.


#### 3.2.4. Resetting Attack

Resetting attack requires the attacker first resets the CUT, at which the state of all scan flip-flops is initialized to all-zeros. Then, the initial state is scanned with the given test authorization code. Finally, the attacker analyses the data from the scan-out result and determines whether the test authorization code is correct. However, the secure scan design proposed in this paper has obfuscation characteristics. When the test authorization code is not correct, the wrong scan key shifted in the NSR, and the scan-out data will also be obfuscated. Hence, inferring the test authorization code bit by bit from the scan-out data does not work. The proposed secure scan design can effectively resist the attacker using resetting attack to threaten the security of the circuit.


### 3.3. Overhead Analysis

In order to analyze area overhead, we perform experiments on AES circuit with Synopsys Design Compiler and Synopsys DFT Compiler. The area without the security design is shown in Table2, and the power consumption is shown in Table 3.Table 2
Area without inserting security design.
Area categoriesAreaCombinational area288499.656516Buf/Inv area82048.231581Noncombinational area63713.608595Macro/black box area0.000000Net interconnect area1611937.031250Total cell area352213.265112Total area1964150.296362Table 3
Power consumption without inserting encryption design.
Internal powerSwitching powerLeakage powerTotal power288.8334 uw9.4736e+04 uw8.9739e+06 nw1.0400e+05 uwThe area and power consumption after inserting the proposed secure scan design with 64-bit test authorization code are shown in Tables4 and 5. By comparing the total area and total power consumption, it can be seen that the overhead and power consumption after inserting encryption design are well within the acceptable range.Table 4
Area overhead with inserting encryption design.
Area categoriesAreaCombinational area288683.274511Buf/Inv area82261.829572Noncombinational area63958.268591Macro/black box area0.000000Net interconnect area1615052.812500Total cell area352641.543102Total area1967694.355602Table 5
Power consumption with inserting encryption design.
Internal powerSwitching powerLeakage powerTotal power311.7226 uw1.0020e+05 uw8.9633e+06 nw1.0948e+05 uwThrough the above analysis, the proposed secure scan design has high security and testability, as well as low area overhead and power consumption.


### 3.4. Overheads and Performance Comparison of Different Countermeasures

The area overhead and performance of the proposed secure scan design are compared with other countermeasures, MKR [30], Mode reset [49], scan chain encryption [40], and so on. The characteristics of these countermeasures are shown in Table 6. It can be seen from the comparison that the proposed secure scan design has many advantages, such as low area overhead, unscathed testing applications, and high security.Table 6
Comparison of different secure scan design. Note: LOC denotes “launch-on-capture.”
DesignArea overhead (%)VulnerabilityProbability of brute forceTest applicationProposed (64 bit authorization code)0.18None2−64(64 is the length of test authorization code)All types of tests can be appliedMKR [30]0.19NoneBrute force is inapplicableOnline testing cannot be appliedMode reset [49]∼10Test-mode-only attacksBrute force is inapplicableOnline testing cannot be appliedScan chain encryption [40]2.92Memory attack2−m(m is the length of test password)All types of tests can be appliedFTSL-64 [59]3.09None2–64Loc delay testing cannot be applied


## 3.1. Testability Analysis

The insertion of security design does not affect the original testability of the circuit. All commonly used testing techniques like stuck-at, and delay test can be applied. As long as the test authorization code is entered correctly, the normal scan operation can be performed, and the scan-out data will not be obfuscated.Targeting at the stuck-at fault model, we do experiments on several big ITC′99 benchmark circuits including B17, B18, B19, B20, and B22. The results show, the fault coverage does not reduce for all these benchmark circuits with the same test set when the proposed secure scan design is integrated into them.Since the added security design only adds logic gates, counters, and triggers, the faults occurring in the security scan design can be easily detected. When faults occur, although the test authorization code entered is correct, the output data will be still obfuscated. Then, the circuit will be treated as faulty one. Therefore, this does not affect the testability of the circuit.


## 3.2. Security Analysis

This section provides a detailed analysis of the security of the proposed structure by means of the following attack models.


### 3.2.1. Brute Force Attack

Since the test authorization code of the circuit is determined by the values in the nonvolatile memory and the way the NSR is connected with the scan chain, it is difficult to guess the test authorization code by brute force without obtaining specific design information about the circuit. The probability of randomly speculating theL-bit test authorization code to perform the scan test correctly is 1/2L.For L = 64, the probability of guessing the test authorization code is only 5.4×10−20. In this case, it is impossible to obtain the test authorization code through brute force attack. In engineering applications, the attack probability and hardware overhead within the controllable range determine the value of L.


### 3.2.2. Differential Attack

Differential attack means that the attacker first runs in functional mode for several cycles and then switches to test mode to obtain an intermediate state [32]. Even if the attacker can dominate the scan chain through the primary input pins, the output data of scan chain will be obfuscated without the correct test authorization code. Therefore, the proposed secure scan structure can resist differential attack.


### 3.2.3. Test-Mode-Only Attack

Test-mode-only differential attack requires attackers to scan specific test vector pairs to obtain valuable information. However, in the proposed secure scan structure, these data will not be properly loaded into the scan chain due to the protection of obfuscation logic. In addition, incorrect keys can be cyclically shifted in the NSR during testing. Therefore, this leaves the obfuscated bits in an indeterminate state for each clock cycle while the scan operation is being performed. Therefore, the secure design proposed in this paper has the ability to resist test-mode-only attack.


### 3.2.4. Resetting Attack

Resetting attack requires the attacker first resets the CUT, at which the state of all scan flip-flops is initialized to all-zeros. Then, the initial state is scanned with the given test authorization code. Finally, the attacker analyses the data from the scan-out result and determines whether the test authorization code is correct. However, the secure scan design proposed in this paper has obfuscation characteristics. When the test authorization code is not correct, the wrong scan key shifted in the NSR, and the scan-out data will also be obfuscated. Hence, inferring the test authorization code bit by bit from the scan-out data does not work. The proposed secure scan design can effectively resist the attacker using resetting attack to threaten the security of the circuit.


## 3.2.1. Brute Force Attack

Since the test authorization code of the circuit is determined by the values in the nonvolatile memory and the way the NSR is connected with the scan chain, it is difficult to guess the test authorization code by brute force without obtaining specific design information about the circuit. The probability of randomly speculating theL-bit test authorization code to perform the scan test correctly is 1/2L.For L = 64, the probability of guessing the test authorization code is only 5.4×10−20. In this case, it is impossible to obtain the test authorization code through brute force attack. In engineering applications, the attack probability and hardware overhead within the controllable range determine the value of L.


## 3.2.2. Differential Attack

Differential attack means that the attacker first runs in functional mode for several cycles and then switches to test mode to obtain an intermediate state [32]. Even if the attacker can dominate the scan chain through the primary input pins, the output data of scan chain will be obfuscated without the correct test authorization code. Therefore, the proposed secure scan structure can resist differential attack.


## 3.2.3. Test-Mode-Only Attack

Test-mode-only differential attack requires attackers to scan specific test vector pairs to obtain valuable information. However, in the proposed secure scan structure, these data will not be properly loaded into the scan chain due to the protection of obfuscation logic. In addition, incorrect keys can be cyclically shifted in the NSR during testing. Therefore, this leaves the obfuscated bits in an indeterminate state for each clock cycle while the scan operation is being performed. Therefore, the secure design proposed in this paper has the ability to resist test-mode-only attack.


## 3.2.4. Resetting Attack

Resetting attack requires the attacker first resets the CUT, at which the state of all scan flip-flops is initialized to all-zeros. Then, the initial state is scanned with the given test authorization code. Finally, the attacker analyses the data from the scan-out result and determines whether the test authorization code is correct. However, the secure scan design proposed in this paper has obfuscation characteristics. When the test authorization code is not correct, the wrong scan key shifted in the NSR, and the scan-out data will also be obfuscated. Hence, inferring the test authorization code bit by bit from the scan-out data does not work. The proposed secure scan design can effectively resist the attacker using resetting attack to threaten the security of the circuit.


## 3.3. Overhead Analysis

In order to analyze area overhead, we perform experiments on AES circuit with Synopsys Design Compiler and Synopsys DFT Compiler. The area without the security design is shown in Table2, and the power consumption is shown in Table 3.Table 2
Area without inserting security design.
Area categoriesAreaCombinational area288499.656516Buf/Inv area82048.231581Noncombinational area63713.608595Macro/black box area0.000000Net interconnect area1611937.031250Total cell area352213.265112Total area1964150.296362Table 3
Power consumption without inserting encryption design.
Internal powerSwitching powerLeakage powerTotal power288.8334 uw9.4736e+04 uw8.9739e+06 nw1.0400e+05 uwThe area and power consumption after inserting the proposed secure scan design with 64-bit test authorization code are shown in Tables4 and 5. By comparing the total area and total power consumption, it can be seen that the overhead and power consumption after inserting encryption design are well within the acceptable range.Table 4
Area overhead with inserting encryption design.
Area categoriesAreaCombinational area288683.274511Buf/Inv area82261.829572Noncombinational area63958.268591Macro/black box area0.000000Net interconnect area1615052.812500Total cell area352641.543102Total area1967694.355602Table 5
Power consumption with inserting encryption design.
Internal powerSwitching powerLeakage powerTotal power311.7226 uw1.0020e+05 uw8.9633e+06 nw1.0948e+05 uwThrough the above analysis, the proposed secure scan design has high security and testability, as well as low area overhead and power consumption.


## 3.4. Overheads and Performance Comparison of Different Countermeasures

The area overhead and performance of the proposed secure scan design are compared with other countermeasures, MKR [30], Mode reset [49], scan chain encryption [40], and so on. The characteristics of these countermeasures are shown in Table 6. It can be seen from the comparison that the proposed secure scan design has many advantages, such as low area overhead, unscathed testing applications, and high security.Table 6
Comparison of different secure scan design. Note: LOC denotes “launch-on-capture.”
DesignArea overhead (%)VulnerabilityProbability of brute forceTest applicationProposed (64 bit authorization code)0.18None2−64(64 is the length of test authorization code)All types of tests can be appliedMKR [30]0.19NoneBrute force is inapplicableOnline testing cannot be appliedMode reset [49]∼10Test-mode-only attacksBrute force is inapplicableOnline testing cannot be appliedScan chain encryption [40]2.92Memory attack2−m(m is the length of test password)All types of tests can be appliedFTSL-64 [59]3.09None2–64Loc delay testing cannot be applied


## 4. Conclusion

In this paper, a secure scan design is proposed to defeat the scan-based side-channel attacks. The proposed design adopts encryption structure, which requires the correct test authorization code to carry out normal test operation. The test authorization code needs to be inferred from both the configuration bit of a nonlinear shift register and the connection style between the nonlinear shift register and the scan chain. The configuration bits are stored in a nonvolatile memory, which can be configured arbitrarily by IP owner and are inaccessible for users and attackers. The proposed structure performs well in testability and security, and its overhead and power consumption are within acceptable range.



---

*Source: 5222670-2021-11-05.xml*