Scan and boundary scan disable mechanism on secure device

• US 7,228,440 B1
• Filed: 12/20/2002
• Issued: 06/05/2007
• Est. Priority Date: 02/13/2002
• Status: Expired due to Fees

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: LSI Corporation (Broadcom, Inc.)
• Inventors: Giles, Christopher M., Bewick, Simon, Williams, Kalvin E.
• Primary Examiner(s): Britt; Cynthia
• Assistant Examiner(s): LOVING, JARIC E
• Application Number:
  US10/325,382
• Time in Patent Office: 1,628 Days
• Field of Search: 726/2, 726/26, 726/27, 726/28, 726/29, 726/30, 725/25, 380/210, 380/211, 380/240, 380/241, 714/30, 714/726, 714/727, 714/729
• US Class Current: 713/168
• CPC Class Codes: G01R 31/31719 Security aspects, e.g. preventing unauthorised access during test
• CPC Class Codes: G01R 31/318555 Control logic
• CPC Class Codes: G01R 31/318591 Tools

Abstract

A circuit generally comprising a logic module and a security module is disclosed. The logic module may be configured to set a plurality of values to a plurality of predetermined values respectively while in a scan mode. The security module may be configured to (i) disable a scan capability of the values while in a non-lowest security mode of at least three security modes and (ii) enabling the scan capability while in a lowest security mode of the security modes.

Claims

1. A circuit comprising:

a plurality of logic modules configured to (i) store a plurality of values and (ii) force said values in storage to a plurality of predetermined values respectively while a scan mode signal is active; and

a security module configured to (i) disable a scan capability to read said values through a first scan chain while in a non-lowest security mode of at least three security modes and (ii) enable said scan capability to read said values through said first scan chain while in a lowest security mode of said at least three security modes.

2. The circuit according to claim 1, wherein said security module is further configured to deactivate said scan mode signal.

3. The circuit according to claim 1, further comprising:

an enable module configured to disable an interface to a test access port of said first scan chain in response to a disable signal generated by said security module.

4. The circuit according to claim 1, further comprising:

an enable module configured to disable an interface to a memory while said scan mode signal is active.

5. The circuit according to claim 4, wherein said first scan chain is further configured to bypass said interface to said memory while said scan mode signal is active.

6. The circuit according to claim 1, further comprising:

a processor having a second scan chain; and

a boot memory having a third scan chain connected in series to said second scan chain.

7. The circuit according to claim 6, wherein said security module is further configured to disable said second scan chain.

8. The circuit according to claim 1, wherein a portion of said first scan chain forms a register designated to store security information.

9. The circuit according to claim 8, wherein said security module is further configured to disable said first scan chain.

10. The circuit according to claim 9, wherein (i) said logic modules and said security module are part of a first chip and (ii) a memory coupled to said first chip is part of a second chip.

11. A method of operating a circuit, comprising the steps of:

(A) storing a plurality of values;

(B) disabling a scan capability to read said values through a scan chain while in a non-lowest security mode of at least three security modes;

(C) forcing said values in storage to a plurality of predetermined values respectively while a scan mode signal is active; and

(D) enabling said scan capability to read said values through said scan chain while in a lowest security mode of said at least three security modes.

12. The method according to claim 11, wherein (i) a multi-bit group of said values define said at least three security modes and (ii) said predetermined values in said multi-bit group correspond to an intermediate security mode of said at least three security modes.

13. The method according to claim 11, wherein (i) a multi-bit group of said values controls access to a test port and (ii) said predetermined values in said multi-bit group disable said test port.

14. The method according to claim 11, wherein (i) a group of said values control an authentication process governing access to said scan chain and (ii) said predetermined values in said group disable said authentication operation.

15. The method according to claim 11, further comprising the step of:

instructing said scan chain to bypass a plurality of registers while said scan mode signal is active.

16. The method according to claim 11, further comprising the step of:

disabling an interface to a memory while said scan mode signal is active.

17. The method according to claim 11, further comprising the step of:

disabling an interface to a memory while in an intermediate security mode of said at least three security modes.

18. The method according to claim 11, further comprising the step of:

disabling an output pin while said scan mode signal is active.

19. The method according to claim 11, further comprising the step of:

disabling an output pin while in a highest security mode of said at least three security modes.

20. A circuit comprising:

means for (i) disabling a scan capability to read a plurality of values through a scan chain while in a non-lowest security mode of at least three security modes and (ii) enabling said scan capability to read said values through said scan chain while in a lowest security mode of said at least three security modes; and

means for (i) storing said values and (ii) forcing said values in storage to a plurality of predetermined values respectively while a scan mode signal is active.