FuseLock: Dynamic Taint-Based Scan Chain Protection with Fuse-Guarded Counters

Present-day Integrated circuits require extensive testing to ensure functionality and efficiency, often outsourced to semiconductor assembly foundries and test (OSAT) facilities. However, this exposure of IP introduces consequential security risks, such as reverse engineering and malicious pattern insertion leading to IP theft. A wide range of solutions have been explored to mitigate these risks, attempting to efficiently streamline the process of testing IC's without having to expose it to third party untrusted vendors. Unfortunately, most of these solutions are accompanied with high test time complexity, test coverage loss, or inconvenient test procedures. To address this, we propose a holistic scan chain security architecture that combines perpattern authentication and selective scan response encryption, tailored for secure testing in untrusted environments. Our work also enables functional testing at OSAT without compromising on test security, avoiding the need to ship the packaged ICs to the design house for activation or for fusing security key/seed. We also use the counter-based mechanism that detects tampering and limits the testing attempts. Our work seamlessly integrates with existing test flow while also providing strong resistance against malicious pattern insertion and threats posed by untrusted third party OSAT, with minimal impact on area and performance.