Secure Scan Architecture Based on Hidden Authorization and Dynamic Replacement
摘要
Scan chains introduced by design for testability (DFT) significantly enhance testability but also expose internal circuit states to scan-based attacks. To address this vulnerability, this paper proposes a secure scan architecture based on hidden authorization and dynamic data replacement. The hidden authorization mechanism emphasizes stealth by concealing the authentication process itself, avoiding explicit key storage, comparison, or observable feedback, thereby preventing attackers from inferring authorization states or triggering conditions. In addition, a new nonlinear feedback shift register (NLFSR) is proposed to generate substituted scan data under unauthorized access. Unlike conventional LFSR-based schemes, the proposed NLFSR employs a highly nonlinear feedback structure, achieving enhanced nonlinearity and strong resistance to algebraic attacks while improving the unpredictability of replacement data. Furthermore, a new replaced critical scan flip-flop (RCSFF) structure is introduced. By relying on the systematic definition and precise localization of critical scan nodes (CSNs), the RCSFF dynamically replaces security critical scan data, effectively disrupting sensitive information leakage without compromising scan functionality. Experimental results demonstrate that the proposed architecture significantly improves resistance to scan-based attacks with low hardware overhead and no impact on test time.