Hardware Security Day 5 – Chip Design, Debug Security, and Hardware Trust

Weeks 2–4 and 7–8 flashcards covering VLSI design and testing, PCB security, scan chains, JTAG, SoC debug, hardware Trojans, counterfeit chips, and IP protection. Practice matching each threat to the access it requires, what it targets, the evidence it leaves, and a suitable defense.

Very-large-scale integration (VLSI)

Designing integrated circuits that combine many transistors on one chip.

VLSI design flow

Start with a functional specification and develop an RTL design. Synthesize it into logic and create the physical layout before fabrication and testing.

Register-transfer level (RTL)

A design description that specifies how data moves between registers and what logic operates on it.

Logic synthesis

Converting an RTL description into a circuit of logic gates.

Physical layout

The placement and routing of circuit elements and connections on a chip.

Design verification

Checking whether a circuit design behaves according to its specification.

Manufacturing test

Checking fabricated chips for defects that can cause incorrect behavior.

Manufacturing yield

The fraction of manufactured chips that meet the required specifications.

CMOS inverter

A low input turns on the pMOS pull-up and produces a high output. A high input turns on the nMOS pull-down and produces a low output.

CMOS NAND pull-down network

Two nMOS transistors in series pull the output low only when both inputs are high.

CMOS NOR pull-down network

Two nMOS transistors in parallel pull the output low when either input is high.

Scan flip-flop

A flip-flop that can capture normal circuit state or shift test data through a serial scan chain.

Scan chain

A series of scan flip-flops connected so test data can be shifted in and captured state can be shifted out.

Scan test sequence

Shift in a test state. Capture the circuit response. Shift out the result for comparison with the expected response.

Controllability

How easily a tester can set internal circuit nodes or registers to desired values.

Observability

How easily a tester can determine the value of an internal circuit node or register.

Scan-chain security risk

Unauthorized scan access can expose sensitive internal state or let an attacker influence that state.

Printed circuit board (PCB)

A board that mounts components and connects them through conductive traces.

PCB bus sniffing

Observing signals on exposed board connections to learn what components exchange.

PCB reverse engineering

Inspecting components and traces to reconstruct how a board is designed or connected.

PCB implant

An added or modified component that can monitor signals or alter board behavior.

JTAG

A standardized test interface that provides a Test Access Port and supports operations such as boundary scan.

Test Access Port (TAP)

The JTAG interface and controller used to select test operations and shift data.

Boundary scan

Using test cells near chip pins to control or observe signals at the chip boundary.

TDI

Test Data In. The pin that receives serial JTAG data.

TDO

Test Data Out. The pin that sends serial JTAG data.

TCK

Test Clock. The signal that clocks JTAG operations.

TMS

Test Mode Select. The signal that controls transitions in the TAP state machine.

BYPASS

A JTAG instruction that selects a one-bit path through a device to shorten the serial scan path.

EXTEST

A JTAG instruction that uses boundary cells to test external connections such as PCB traces between chips.

INTEST

A JTAG instruction that uses boundary cells to test internal logic on devices that support it.

JTAG authentication

Verifying that a debugger is authorized before granting access to test or debug functions.

JTAG challenge-response

The device issues a fresh challenge and checks the debugger's cryptographic response before granting access.

Permanent debug lock

Disabling a debug interface after manufacturing to reduce exposure at the cost of field diagnostics.

System on chip (SoC)

A chip that integrates several functions such as processors and memory controllers and peripheral interfaces.

Third-party hardware IP

A reusable design block supplied by another organization and integrated into a larger chip.

Debug trace

A record of selected events during execution that helps engineers diagnose hardware or software behavior.

SoC debug trace leakage

Trace data can reveal execution flow and may expose proprietary firmware or information about cryptographic operations.

Debug trace compression

Encoding trace data in fewer bits. A debugger that can decode the format may still recover sensitive information.

Debug access control

Limiting who can enter debug mode and which operations or traces each authorized role may use.

Hardware Trojan

An intentional malicious modification to hardware that can leak information or change device behavior.

Hardware Trojan trigger

The condition that activates a Trojan payload. Examples include a rare input pattern or a counter reaching a particular value.

Hardware Trojan payload

The malicious effect of a Trojan such as leaking data or corrupting a calculation or disabling a device.

Always-on hardware Trojan

A malicious modification that affects the circuit continuously without waiting for a rare trigger.

Hardware Trojan vs. hardware bug

A Trojan is intentional. A bug is accidental. Either can produce unexpected behavior.

Functional testing for Trojans

Applying test inputs and checking the outputs. Rare triggers can escape detection if the tests never activate them.

Side-channel detection of Trojans

Looking for unexpected changes in signals such as power consumption or circuit delay that could indicate extra or altered hardware.

Manufacturing variation in Trojan detection

Normal differences between chips can change power and delay and make a suspicious signature harder to interpret.

Recycled counterfeit chip

A previously used component sold as new.

Remarked counterfeit chip

A component relabeled to misrepresent its identity or speed grade or other specifications.

Unauthorized overproduction

Producing extra chips beyond the quantity approved by the design owner and selling them without authorization.

Out-of-spec counterfeit

A part sold as meeting a specification that it fails to meet.

Cloned chip

An unauthorized copy made to imitate a genuine component.

Forged documentation

False records that misrepresent a component's source or test history or chain of custody.

External visual inspection

Looking for suspicious markings or resurfacing or other visible signs of tampering.

X-ray fluorescence (XRF)

Identifying material composition such as the metal used in a component's lead finish.

X-ray inspection or tomography

Examining internal features such as the die and bond wires without opening the package.

Scanning acoustic microscopy

Using sound waves to detect internal defects such as delamination between package layers.

Parametric testing

Measuring electrical characteristics such as leakage current or timing and comparing them with specified limits.

Functional testing for counterfeit parts

Checking whether a component performs its intended functions. A recycled or remarked part can still pass a basic function check.

Active hardware metering

Requiring authorized activation of each device to control use and limit unauthorized overproduction.

Physical unclonable function (PUF)

A circuit that uses manufacturing variation to produce device-specific responses to challenges.

PUF response reliability

The ability to reproduce a response from the same device despite changes such as temperature or voltage.

Hardware IP watermark

A verifiable signature embedded in a design that can provide evidence of ownership.

Constraint-based watermark

Adding design constraints so the resulting implementation carries a recognizable signature while meeting its functional requirements.

Test-based watermark

An embedded signature that can be verified through selected test responses.

Watermark removal or forgery

An adversary may try to erase an ownership signature or fabricate evidence of ownership. A coincidental match can also support a false claim.

Hardware obfuscation

Changing how a design is represented or implemented to make it harder to understand or reverse-engineer.

PUF vs. metering vs. watermark

A PUF can help identify a device. Active metering controls activation. A watermark provides evidence of design ownership.