Reverse Engineering Overcoming Scan Compression Structures

A vast majority of the modern digital VLSI devices utilize a technique called 'full scan' for production testing. This technique concatenates all the device registers (flip-flops or latches) in a few shift registers called 'scan chains'. In this configuration, a production tester may use the scan chains to drive logic values to the inputs of combinatorial circuits, sample the results from their outputs, output the results via the same scan chains and check them with the expected results. This method enables testing every chip for correct behavior, and making sure no defects were inserted during chip production. The full scan technique is an effective technique that allows for reaching high test coverage in a short development time. However, in applications where security (e.g. data confidentiality, IP protection, etc) is a concern, it can introduce a serious threat. Attackers may exploit the scan chains to reverse engineer the whole device. Modern techniques, such as scan compression are considered as protection measures against such attacks. Our goal in this project is to show that even with scan compression, reverse engineering is still possible.

In this project, the student will insert scan and scan compression to some digital core. Further, they will use methods described in academic literature to learn the device contents with the presence of scan compression. The project will comprise of the following stages:

  • Picking an open source digital core for the experiment
  • Synthesizing the core and inserting scan using Synopsys tools
  • Picking a compression engine and integrating it with the design
  • Applying algorithms for learning the chip contents overcoming the masking by the compression engine

In the course of this projects, the students will learn the chip implementation flow, i.e. synthesis and scan insertion using Synopsys tools. In addition, they will get acquainted with the modern scan compression techniques. Finally, they will taste the art of reverse engineering.

Prerequisites: Logic Design, Switching Circuits