Partial Scan Design Against Scan-Based Side Channel Attacks

Testing is essential to isolate good chips from faulty ones. Scan chain, which provides test engineer access to all the flip flops in the chip, is the backbone of industrial testing methods. However, attackers can also leverage the controllability and observability of scan chain as a side channel to break systems such as cryptographic chips. In this paper, we develop a partial scan chain based approach to prevent side channel attacks. The basic idea is to remove the flip flops that store sensitive information from the full scan chain. However, the challenge is how to keep the full test coverage as we demonstrate that using industrial design tools such as traditional partial scan not only fails to provide full fault coverage, but also incurs huge overhead in test time and test vector generation time. We use a novel finite state machine (FSM) structure to deliver secure controllability of the un-chained flip flops to test engineers while using lightweight LFSR and XOR to enable the observability. We conduct experiments to demonstrate that the proposed partial scan, comparing to the full scan, gives full test coverage with reduced test time and does not need to re-generate test vectors.