Defense of JTAG I/O network

Patent metadata

Field	Value
Publication number	US-11856096-B2
Application number	US-202117303648-A
Country	US
Kind code	B2
Filing date	Jun 3, 2021
Priority date	Jun 12, 2020
Publication date	Dec 26, 2023
Grant date	Dec 26, 2023

Abstract

An integrated circuit includes, in part, a key management unit configured to generate a seeding key during a start-up phase, an encryption module configured to encrypt data using the seeding key and deliver the encrypted data to a second integrated circuit, and an encoder configured to encode the seeding key and deliver the encoded seeding key to the second IC. The second integrated circuit includes, in part, a decoder configured to decode the seeding key. Each of the integrated circuits further includes, in part, a linear-feedback shift register that receives the same clock signals and loads the seeding key.

First claim

We claim:

1. A method for delivering data from a first integrated circuit (IC), the method comprising:
generating, by the first IC, a seeding key during a start-up phase of the first IC;
generating, by a linear-feedback shift register disposed in the first IC, a key based at least in part on the seeding key, wherein the key is one of a set of keys generated by loading the seeding key to the linear-feedback shift register disposed in the first IC;
encrypting, by the first IC, the data using the key to generate encrypted data;
encoding, by the first IC, the seeding key to obtain encoded seeding key;
transmitting, by the first IC, the encoded seeding key to a second IC, wherein the encoded seeding key is decoded to obtain decoded seeding key, wherein the key is generated by a linear-feedback shift register disposed in the second IC based at least in part on the decoded seeding key, and wherein the linear-feedback shift register disposed in the second IC performs the same operation as that of the linear-feedback shift register disposed in the first IC; and
transmitting, by the first IC, the encrypted data to the second IC, wherein the encrypted data is decrypted using the key.

2. The method of claim 1 further comprising:
loading, by the second IC, the decoded seeding key to the linear-feedback shift register disposed in the second IC.

3. The method of claim 2 further comprising:
applying a same clock signal to the linear-feedback shift registers disposed in the first and second ICs.

4. The method of claim 3 further comprising:
decoding, by the second IC, the encoded seeding key using a plurality of states of a state machine.

5. The method of claim 4 wherein said decoding is performed by a Joint Test Action Group (JTAG) block disposed in the second IC.

6. The method of claim 5 wherein said state machine is disposed in a test access port (TAP) controller of the JTAG block.

7. The method of claim 6 wherein the data is supplied by a plurality of boundary scan chain cells disposed in the first IC.

8. The method of claim 7 wherein if the decoded seeding key at the second IC fails to match an expected seeding key, a clock signal causing the second IC to lock is applied thereto.

9. The method of claim 8 wherein said seeding key is generated using a physically unclonable function (PUF) characteristic of the first IC.

10. A first integrated circuit comprising:
a key management unit configured to generate a seeding key during a start-up phase of the first integrated circuit (IC);
a linear-feedback shift register configured to generate a key based at least in part on the seeding key, wherein the key is one of a set of keys generated by loading the seeding key to the linear-feedback shift register disposed in the first IC;
an encryption module configured to encrypt received data using the key and transmit the encrypted data to a second IC; and
an encoder configured to encode the seeding key to obtain encoded seeding key and transmit the encoded seeding key to the second IC, wherein the encoded seeding key is decoded to obtain decoded seeding key, wherein the key is generated by a linear-feedback shift register disposed in the second IC based at least in part on the decoded seeding key, wherein the linear-feedback shift register disposed in the second IC performs the same operation as that of the linear-feedback shift register disposed in the first IC, and wherein the encrypted data is decrypted using the key.

11. The first integrated circuit of claim 10 ,
wherein the linear-feedback shift register is configured to store the seeding key.

12. The first integrated circuit of claim 11 wherein said second IC comprises a decoder configured to decode the encoded seeding key, and wherein the linear-feedback shift register disposed in the second IC is configured to load the decoded seeding key.

13. The first integrated circuit of claim 12 wherein the linear-feedback shift registers disposed in the first and second ICs receive a same clock signal.

14. The first integrated circuit of claim 13 wherein the second IC further comprises:
a state machine having a plurality of states decoding the encoded seeding key.

15. The first integrated circuit of claim 14 wherein said state machine is disposed in a Joint Test Action Group (JTAG) block of the second IC.

16. The first integrated circuit of claim 15 wherein said state machine is disposed in a test access port (TAP) controller of the JTAG block.

17. The first integrated circuit of claim 16 further comprising:
a plurality of boundary scan chain cells disposed in the first IC and configured to supply the data.

18. The first integrated circuit of claim 17 further comprising:
a comparator disposed in the second IC, said comparator configured to cause the second IC to receive a clock signal causing the second IC to lock if the decoded seeding key fails to match an expected key.

19. The first integrated circuit of claim 18 wherein said seeding key is generated using a physically unclonable function (PUF) characteristic of the first IC.

Assignees

• Univ Florida

Inventors

• Bhunia Swarup
• Vega Christopher
• Paul Shubhra Deb
• Difuntorum Parker
• Dizon Reiner
• Sristi Lakshmiprasanna Sriramakumara Patanjali

Classifications

• H04L9/088 Primary

  Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068) · CPC title

• G06F1/04

  Generating or distributing clock signals or signals derived directly therefrom · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title

• H04L9/004 Primary

  for fault attacks · CPC title

• H04L9/003

  for power analysis, e.g. differential power analysis [DPA] or simple power analysis [SPA] · CPC title