Secure Software/Hardware Hybrid In-Field Testing for System-on-Chip

Abstract

This paper introduces a novel, low-overhead software/hardware hybrid approach for secure in-field testing of Systems-on-Chip (SoCs), addressing the security risks and technical limitations of traditional BIST methods. The core innovation utilizes the SoC processor for flexible test scheduling and integrates Keyed-Hash Message Authentication Code (KMAC) to generate device-specific secure and valid signatures, eliminating aliasing. Demonstrated on a RISC-V-based SoC, this methodology enables robust, verifiable on-chip and remote testing necessary for modern integrated circuits.

Report

Secure Software/Hardware Hybrid In-Field Testing for System-on-Chip

Key Highlights

• Hybrid Approach: Introduces a combined software/hardware methodology to perform Built-in Self-Test (BIST) securely and efficiently in the field.
• Security Focus: Aims to resolve the vulnerability where BIST results expose the internal structure and state of the Device Under Test (DUT), creating attack vectors.
• KMAC Integration: Leverages the SoC's Keyed-Hash Message Authentication Code (KMAC) functionality to produce secure, device-specific, and cryptographically valid test signatures.
• Zero Aliasing: The KMAC-based compaction method successfully overcomes the issues of aliasing and invalid signatures associated with traditional result compaction techniques.
• Flexibility: The approach utilizes the SoC processor for test scheduling, increasing DUT availability and supporting both on-chip and remote testing capabilities.
• Demonstration: The methodology is showcased and validated on a RISC-V-based System-on-Chip.

Technical Details

• Target Architecture: Systems-on-Chip (SoCs) incorporating deeply integrated Intellectual Property (IP) blocks.
• Compaction Technique: Replaces vulnerable BIST chain compaction with KMAC hashing for signature generation.
• Test Control: The general-purpose SoC processor is responsible for orchestrating and scheduling the testing process (Software-BIST component).
• Signature Security: KMAC provides a keyed hash, ensuring the signature is both device-specific (keyed) and tamper-proof (hashed), preventing attackers from inferring internal device structure from test results.
• Metrics: The paper discusses the resulting system overhead and achieved compaction rates of the proposed hybrid scheme.
• Scope: Addresses the limitations of both classical BIST (security risk) and pure Software-BIST (limited observability and fault coverage).

Implications

• Enhanced Security for Deployed Devices: This technique is vital for securing critical SoCs (e.g., in automotive or IoT infrastructure) where secure in-field diagnostics and lifecycle management are mandatory. It allows for integrity checks without risking hardware reverse-engineering.
• Advancing RISC-V Ecosystem Integrity: By successfully implementing and demonstrating the secure hybrid testing mechanism on a RISC-V-based SoC, the paper provides a crucial blueprint for hardware designers leveraging the open architecture. This enhances the security confidence in RISC-V platforms.
• Reliable Diagnostics: By eliminating aliasing, the method ensures that diagnostic signatures are accurate and reliable, drastically improving the precision of fault detection and classification compared to older compaction techniques.
• Remote Maintenance Capability: The support for remote testing enables manufacturers and operators to securely verify the hardware health of deployed devices without physical access or complex debug interfaces.