Jeremy Lee

Securing Designs against Scan-Based Side-Channel Attacks

Traditionally, the only standard method of testing that has consistently provided high fault coverage has been scan test due to the high controllability and high observability this technique provides. The scan chains used in scan test not only allow test engineers to control and observe a chip, but these properties also allow the scan architecture to be used as a means to breach chip security. In this paper, we propose a technique, called Lock & Key, to neutralize the potential for scan-based side-channel attacks. It is very difficult to implement an all inclusive security strategy, but by knowing the attacker, a suitable strategy can be devised. The Lock & Key technique provides a flexible security strategy to modern designs without significant changes to scan test practices. Using this technique, the scan chains are divided into smaller subchains. With the inclusion of a test security controller, access to subchains are randomized when being accessed by an unauthorized user. Random access reduces repeatability and predictability making reverse engineering more difficult. Without proper authorization, an attacker would need to unveil several layers of security before gaining proper access to the scan chain in order to exploit it. The proposed Lock & Key technique is design independent while maintaining a relatively low area overhead.

Securing Scan Design Using Lock and Key Technique

Scan test has been a common and useful method for testing VLSI designs due to the high controllability and observability it provides. These same properties have recently been shown to also be a security threat to the intellectual property on a chip (Yang et al., 2004). In order to defend from scan based attacks, we present the lock & key technique. Our proposed technique provides security while not negatively impacting the designs fault coverage. This technique requires only that a small area overhead penalty is incurred for a significant return in security. Lock & key divides the already present scan chain into smaller subchains of equal length that are controlled by an internal test security controller. When a malicious user attempts to manipulate the scan chain, the test security controller goes into insecure mode and enables each subchain in an unpredictable sequence making controllability and observability of the circuit under test very difficult. We present and analyze the design of the lock & key techniques to show that this is a flexible option to secure scan designs for various levels of security

Layout-Aware Pattern Generation for Maximizing Supply Noise Effects on Critical Paths

As technology scales, gate sensitivity to noise increases due to supply voltage scaling and limited scaling of the voltage threshold. As a result, power supply noise plays a greater role in sub-100nm technologies and creates signal integrity issues in the chip. It is vital to consider supply voltage noise effects (i) during design validation to apply sufficient guardbands to critical paths and (ii) during path delay test to ensure the performance and reliability of the chip. In this paper, a novel layout-aware pattern generation procedure for maximizing power supply noise effects on critical paths while considering local voltage drop impacts is proposed. The proposed pattern generation and validation flow is implemented on the ITC’99 b19 benchmark. Experimental results for both wire-bond and flip-chip packaging styles are presented in this paper. Results demonstrate that our proposed method is fast, significantly increases switching around the functionally testable critical paths, and induces large voltage drop on cells placed in the critical paths which results in increased path delay. The proposed method eliminates the very time consuming pattern validation phase that is practiced in industry.

Layout-aware, IR-drop tolerant transition fault pattern generation

Market and customer demands have continued to push the limits of CMOS performance. At-speed test has become a common method to ensure these high performance chips are being shipped to the customers fault-free. However, at-speed tests have been known to create higher-than-average switching activity, which normally is not accounted for in the design of the power supply network. This potentially creates conditions for additional delay in the chip; causing it to fail during test. In this paper, we propose a pattern compaction technique that considers the layout and gate distribution when generating transition delay fault patterns. The technique focuses on evenly distributing switching activity generated by the patterns across the layout rather than allowing high switching activity to occur in a small area in the chip that could occur with conventional delay fault pattern generation. Due to the relationship between switching activity and IR-drop, the reduction of switching will prevent large IR-drop in high demand regions while still allowing a suitable amount of switching to occur elsewhere on the chip to prevent fault coverage loss. This even distribution of switching on the chip will also result in avoiding hot-spots.

LS-TDF: Low-Switching Transition Delay Fault Pattern Generation

Higher chip densities and the push for higher performance have continued to drive design needs. Transition delay fault testing has become the preferred method for ensuring these chips operate at the specified frequency. However, current industrially used X-filling (random-fill or compression) schemes tend to generate transition delay fault patterns with switching activity much higher than what would be seen during functional mode operation of the chip, potentially causing failures that would not occur in the field. In this paper, we present a low- switching transition delay fault pattern generation flow. The flow short-lists patterns based on high switching activity, which is determined by the fault lists of each pattern. Once those patterns with high switching are filtered, they will be replaced by low-switching patterns to recover any lost fault coverage. The proposed pattern generation flow works well with commercial tools and can easily be integrated into an industrial flow.

A Novel Pattern Generation Framework for Inducing Maximum Crosstalk Effects on Delay-Sensitive Paths

The limitations of pattern generation tools are beginning to surface as parasitic coupling capacitance in high speed interconnects only worsens as the industry approaches sub-50 nm technologies. This can create a gap between the delay experienced on critical and long paths during test and the delay of the same paths in the field. In this paper, we propose a novel structural test pattern generation procedure that magnifies parasitic crosstalk effects on delay-sensitive paths by inducing switching on nearby nets which have been identified using the parasitic information of the layout. This will ensure timing closure on the targeted path is still met while also minimizing escape ratio and improving in the field reliability. Results of the proposed layout-aware approach demonstrate the ability of the proposed framework to significantly increase crosstalk around the targeted delay-sensitive paths.

Layout-Aware Transition-Delay Fault Pattern Generation with Evenly Distributed Switching Activity

As chip integration continues to increase and technology scaling is forcing the operating voltage to decrease, modern designs have become more susceptible to supply voltage noise. However, even with a well designed power distribution network, modern at-speed test pattern generation techniques do not consider the maximum current throughput the network will be able to provide. As a result, conventional transition delay fault pattern generation tends to create a number of patterns that cause higher-than-average functional switching, which may cause timing and/or functional failures during test. In this paper, we propose a flow that incorporates the layout information and the locality of the switching activity during pattern generation to provide insight into the amount of tolerable switching. This will prevent both IR-drop related hot-spots and under-utilization of the chip since the switching activity can be evenly spread across the design. The results presented in this paper show significant improvement over our previous flow without negatively impacting fault coverage and pattern count.

Pattern grading for testing critical paths considering power supply noise and crosstalk using a layout-aware quality metric

Power supply noise and crosstalk are considered as the two major noise sources that negatively impact signal integrity in digital integrated circuits. In this paper, we propose a novel quality metric to evaluate path-delay fault test patterns in terms of their ability to cause excess delay on targeted critical paths. The proposed procedure quickly selects the best set of patterns for testing the critical paths under power supply noise and crosstalk effects. It also offers the design engineers a quick approach to evaluate the critical paths in static timing analysis (STA) and silicon to improve timing margin strategies. Simulation results demonstrate that the patterns selected by the proposed methodology generate the worst-case supply noise and crosstalk effects on target paths.

Protecting IPs Against Scan-Based Side-Channel Attacks

The need for on-chip security has been on the rise with the proliferation of cryptochips and other applications that contain intellectual property that must be protected. In order to test these chips, scan-based testing has been commonly used due to the ease of application and high coverage. However, once in the field, the test ports become a liability due to the amount of controllability and observability scan-based testing provides. This chapter presents a low-cost secure scan solution that allows the ease of testing using a scan while maintaining a high level of security that will protect the on-chip IP. The proposed solution authorizes users through the use of a test key that is integrated directly into the test pattern and will prevent unauthorized users from correctly analyzing the responses from the scan chain. The area overhead of the proposed solution is negligible, has no impact on performance, and adds several layers of security on top of the scan chain without modifying the standard test interface.

Power Distribution Failure Analysis Using Transition-Delay Fault Patterns

Power distribution networks (PDNs) have been a vital part of modern designs. However, scaling technologies have increased the likelihood of defects in the PDN that may affect yield, escape, and reliability. Failure analysis is particularly difficult since there is no direct access to the PDN as there is to the design logic. We present a flow that generates transition-delay fault patterns to target open defects on the PDN. The flow identifies regions that could be susceptible to open defects and generates patterns that will exercise those regions to increase the likelihood of a timing failure should a defect exist in the PDN.