Securing Boundary Scan Chains: Encryption and Access Control

The Joint Test Action Group (JTAG) , an international standard testing protocol (IEEE 1149.1 compatible), is primarily used for internal chip testing to address chip testing issues. However, the powerful functionality of the JTAG poses a serious threat to the security of chips and devices when maliciously exploited. Due to the serial input nature of scan chain data, malicious users can use basic hardware to access data in the chain, leading to key or information leakage. They can also manipulate the test chain to cause abnormal data input/output or switch the circuit's operating mode, resulting in chip malfunction. To mitigate these threats, this paper designs and implements a hardware prototype system, including a stream encryption module and a Role-Based Access Control (RBAC) permission management module. The stream encryption module encrypts scan chain data to prevent unauthorized access, while the RBAC permission management module ensures that only authorized users or roles can access the corresponding scan chain data. By integrating these two modules and working in coordination with the JTAG, comprehensive protection of the scan chain is achieved. Experimental results demonstrate that the designed encryption monitoring scheme and permission allocation technology effectively protect the boundary scan chain from unauthorized access and malicious attacks. Furthermore, they can manage the usage permissions of authorized users to reduce the risk of unauthorized use in case of chip key leakage. Despite increased resource consumption in terms of time and space, the system remains within estimated ranges.