Abstract Modern System-on-Chip (SoC) designs integrate various embedded instruments and proprietary data to support critical operations such as testing, diagnosis, and in-field health monitoring. The IEEE Std. 1687 (IJTAG) is widely adopted to provide efficient and flexible access to these on-chip instruments. However, its reconfigurable nature exposes a significant attack surface, making it vulnerable to advanced security threats, including machine learning, differential analysis, and power analysis attacks, which can extract Chip IDs and cryptographic keys. To enhance the security of the IJTAG architecture, a secure access protocol has been proposed in the literature. In this secure access scheme, a random number generator produces a bitstream, and whenever a predefined template matches, a key bit is inserted into the bitstream; this process continues until all key bits are embedded. However, the reliance on a single static template renders the scheme predictable and susceptible to key recovery. To overcome this limitation, we propose a multi-dynamic template based secure access protocol , where multiple templates are employed for key insertion. For each comparison, the specific template is dynamically selected based on the last generated bit of the bitstream, thereby introducing randomness into the embedding process and obfuscating adversarial analysis. The experimental evaluation demonstrates that, with eight templates, the proposed protocol reduces machine learning attack accuracy from 98.31 to 0.0002%, increases the complexity of differential analysis by extending the key retrieval time from 3 ms to approximately $$ 1.67 \times 10^{10} $$ 1.67 × 10 10 years, and renders power analysis attacks completely infeasible. In addition, the proposed scheme significantly reduces the bitstream length required for key insertion. For instance, with a 16-bit template and a 256-bit key, the required bitstream length decreases from 16.6 million to 12.8 thousand, while for a 24-bit template and a 256-bit key, it decreases from 4.2 billion to 57.2 thousand, while maintaining security. Furthermore, hardware synthesis on ITC’16 IJTAG benchmarks confirms negligible implementation cost, with area overheads of only 1.65% and 1.53% for the TreeFlatEx and TreeBalanced benchmarks, respectively. These results demonstrate that the proposed protocol provides scalable, resource-efficient and robust protection for IJTAG-enabled SoCs against state-of-the-art attacks.

The increasing complexity and core count of modern System-on-Chips (SoCs) have raised significant concerns regarding test time and test data volume. Despite advancements in SoC design, the physical size of SoCs remains relatively constant, imposing stringent constraints on the number of additional I/O pins to support parallel testing. Furthermore, the disparity in scan chain lengths exacerbates these challenges due to padding requirements, which significantly increase the test data volume. Recently, a novel test architecture, the Streaming Scan Network (SSN), has been introduced, which demonstrates a significant reduction in both test time and test data volume. However, the SSN lacks robust security countermeasures, making it susceptible to threats such as unauthorized access and data tampering. To mitigate these threats, this article presents a lightweight and inherently secure solution that leverages the IJTAG Static Test Data Register (TDR) as a dual-functional module, ensuring both security and the preservation of the SSN’s original functionality. The experimental results demonstrate that the proposed countermeasure incurs 9.08%, 18.34%, 77.54%, and 167.28% less area overhead compared to the state-of-the-art Masking, NLFSR, UAU, and ROT countermeasures, respectively, while maintaining a security level equivalent to a 1024-bit key. Additionally, the proposed approach maintains low computational overhead and minimal authorization cycles, making it a scalable and practical solution for secure SoC testing.

Hardware Trojans (HTs) pose substantial security threats to Integrated Circuits (ICs), compromising their integrity, confidentiality, and functionality. Various HT detection methods have been developed to mitigate these risks. However, the limited availability of comprehensive HT benchmarks necessitates designers to create their own for evaluation purposes. Moreover, the existing benchmarks exhibit several deficiencies, including a restricted range of trigger nodes, susceptibility to detection through random patterns, lengthy HT instance creation and validation process, and a limited number of HT instances per circuit. To address these limitations, we propose a Compatibility Graph assisted automatic Hardware Trojan insertion framework for HT benchmark generation. Given a netlist, this framework generates a design incorporating single or multiple HT instances according to user-defined properties. It allows various configurations of HTs, such as a large number of trigger nodes, low activation probability and large number of unique HT instances. The experimental results demonstrate that the generated HT benchmarks exhibit exceptional resistance to state-of-the-art HT detection schemes. Additionally, the proposed framework achieves an average improvement of 37815.7x and 989.4x over the insertion times of the Random and Reinforcement Learning based HT insertion frameworks, respectively.

Intestinal Parasitic Infections (IPIs) continue to pose a significant global health challenge, disproportionately affecting vulnerable populations and straining healthcare systems, particularly in resource-constrained environments. The accurate and automated detection of parasitic eggs in microscopic images is critical for timely diagnosis and treatment. However, Intra class Variation (ICVs) in egg morphology, influenced by developmental stage variability, often leads to misclassifications with high confidence in deep learning models. To address this challenge, the Augmentation-Based Supervised Target Learning (ASTL) approach is introduced to enhance the models robustness against developmental stage variability. In addition, the IPI-CVx framework is proposed, integrating ASTL with a preprocessing pipeline to mitigate data heterogeneity and improve detection accuracy and reliability. Experimental results demonstrate that IPI-CVx surpasses state-of-the-art models, achieving 97. 3% mean average precision (mAP), 97. 6% mean intersection over union (mIoU) and a 97. 9% F1 score. By effectively addressing ICVs and reducing misclassifications that have high confidence, the proposed framework enhances robustness and interpretability, fostering trust and transparency for clinical deployment.

Modern advancements in hardware implementation of Deep Neural Networks (DNNs) have underscored the need for efficient and accurate nonlinear activation function approximations to reduce computational complexity in resource-constrained environments like FPGA. Traditional methods face challenges in achieving an optimal balance between accuracy and hardware efficiency. To address this, we propose PSO-GP, an automated framework that formulates the approximation as an optimization problem. In this framework, Genetic Programming (GP) approximates complex functions in linear functions, while Particle Swarm Optimization (PSO) identifies optimal interval partition to minimize error. The experimental results demonstrate that PSO-GP significantly improves accuracy and reduces hardware overhead compared to state-of-the-art methods.

As System-on-Chip (SoC) architecture becomes increasingly complex, the need for secure and efficient testing methodologies have grown. Recently, the Streaming Scan Network (SSN) was introduced as a testing infrastructure to address the limitations of conventional scan-based architectures in handling complex SoCs. However, SSN architecture presents significant security risks if access control mechanisms are not implemented. Malicious users could exploit the SSN to extract sensitive information from the SoC, posing a serious threat to system security. To address these vulnerabilities, this paper proposes a secure SSN architecture that employs test vector encryption and test response masking. Further, test authorization key is needed to access the test responses. The proposed solution secures the SSN while keeping the functionality intact and additionally reduces the area overhead compared to existing schemes.

Logic locking has emerged as a crucial defense mechanism for securing ICs against threats such as IP theft, counterfeiting, and Hardware Trojans (HTs). However, advanced attacks like Boolean Satisfiability (SAT) attack have exposed vulnerabilities by exploiting scan-unlocked oracle to retrieve secret keys. To mitigate this risk, scan obfuscation techniques were introduced to secure scan access and enhance protection against SAT attack. However, ScanSAT attack has been shown to bypass these defenses, successfully retrieving secret keys even from scan-obfuscated circuits. Recently, a test authentication scheme combined with scan obfuscation has been proposed as a countermeasure against ScanSAT attack.This work presents an attack that employs a stealthy HT to subvert the security provided by the test authentication scheme. Our analysis demonstrates that the inserted Trojan not only facilitates the execution of the ScanSAT attack but also eludes detection by the state-of-the-art Hardware Trojan detection techniques. These results highlight critical vulnerabilities in current IC security measures, emphasizing the need for resilient defenses against increasingly sophisticated attacks.

This paper proposes a novel security framework that integrates Logic locking with intrinsic SRAM PUFs for simultaneous user authorization and hardware authentication. By leveraging stable SRAM cell responses, the approach eliminates external key storage, deriving unlocking keys through a structured transformation process. Experimental validation on ESP32 devices demonstrates high intra-device response consistency and distinct inter-device signatures. This unified mechanism ensures that only authorized users can access the system and only authenticated ICs can function, mitigating risks of overproduction and external attacks. The results establish SRAM PUFs as a lightweight, efficient, and tamper-resistant solution for secure key derivation.

Main memory plays a pivotal role in the storage of computational data in a wide range of applications, including highly sensitive assets such as banking transactions, cryptographic keys, and user credentials. However, memory systems remain vulnerable to advanced physical and side-channel attacks, including cold boot attacks that exploit residual data after power-down. To mitigate such risks, Intel’s DDR3 memory scrambler uses a Linear Feedback Shift Register (LFSR)-based stream cipher to obscure memory contents. Nevertheless, this mechanism has been shown to be susceptible to stencil attack, a cold boot technique that reconstructs the scrambling key by leveraging the linear and periodic nature of the keystream. This article proposes a novel, lightweight, and secure scrambling architecture based on a generic LFSR designed to enhance the security of DDR3 memory against cold boot attacks. The proposed generic LFSR-based mechanism eliminates differential keystream periodicity by introducing an address- and seed-dependent LFSR structure, thereby rendering differential key recovery techniques computationally infeasible. Furthermore, unlike traditional AES-based memory encryption that incurs high latency and area overhead, the proposed approach achieves comparable security guarantees with low hardware complexity and zero access latency. The hardware implementation results on the Xilinx VCU118 FPGA show that the proposed scheme consumes only 252 LUTs, 256 registers and 104 slices, comparable to the Intel DDR3 scrambler, while offering superior resilience against the cold boot, warm boot, and probing attacks. These results demonstrate the practicality of the proposed scheme for secure memory systems in resource-constrained environments.

Change point detection (CPD) is a valuable technique in time series (TS) analysis, which allows for the automatic detection of abrupt variations within the TS. It is often useful in applications such as fault, anomaly, and intrusion detection systems. However, the inherent unpredictability and fluctuations in many real-time data sources pose a challenge for existing contemporary CPD techniques, leading to inconsistent performance across diverse real-time TS with varying characteristics. To address this challenge, we have developed a novel and robust online CPD algorithm constructed from the principle of discriminant analysis and based upon a newly proposed between-class average and variance evaluation approach, termed B-CAVE. Our B-CAVE algorithm features a unique change point measure, which has only one tunable parameter (i.e. the window size) in its computational process. We have also proposed a new evaluation metric that integrates time delay and the false alarm error towards effectively comparing the performance of different CPD methods in the literature. To validate the effectiveness of our method, we conducted experiments using both synthetic and real datasets, demonstrating the superior performance of the B-CAVE algorithm over other prominent existing techniques.

The scan design is a widely accepted technique employed to enhance the testability of VLSI designs. However, it introduces exploitable side channels that allow attackers to illicitly access confidential information within crypto-cores. To address this concern, several countermeasures have been proposed. Among these countermeasures, two specific types include obfuscation and encryption of the test response at the Scan-Out (SO) port, rendering the test response inaccessible for analysis by potential attackers. This paper proposes a scan attack that effectively retrieves the AES encryption key, even in the presence of both obfuscation and encryption countermeasures.

Test data volume and test time have become a major concern in the testing of complex System on Chips (SoCs). This is due to the fact that the complexity, as well as the number of cores, keeps increasing while the physical size of SoCs remains relatively constant. Consequently, there is limited space available for additional IO pins for scan purposes, which restricts the ability to test multiple cores in parallel. Moreover, testing multiple cores concurrently with different scan chain lengths further increases the test data volume and test time due to the padding. To mitigate the above problems, a new testing architecture called a Streaming Scan Network (SSN) has been recently developed. It is a bus-based architecture that enables the testing of multiple cores with reduced test data volume and test time. However, the SSN-based architecture lacks essential security features, rendering it susceptible to various security threats, including unauthorized user access, as well as data sniffing and alteration attacks. In this paper, a simple, lightweight, inherently secure solution is proposed to counteract the above security threats. The proposed approach involves leveraging IJTAG static registers to incorporate security features into the SSN architecture. The proposed solution keeps the SSN functionality intact and incurs a minimal area overhead as compared to the existing solutions.

Scan design is the most commonly used technique to ensure high test coverage in contemporary chips. However, attackers may use it as a trapdoor to gain access to the chip internals. Thus, it affects the overall chip security. Several techniques have been proposed to protect sensitive data from hackers. Recently, a countermeasure has been proposed that obfuscates the scan data using a test key. This scheme looks simple and effective against all the existing scan-based attacks. However, a detailed analysis of the scheme reveals that it is vulnerable to scan-based side-channel attacks. In this paper, it is shown that the test key could be retrieved successfully, and hence the security provided by this scheme is rendered ineffective. To address this vulnerability, a countermeasure is also proposed.

Modern VLSI circuits feature various embedded instruments that support non-functional features, e.g., test/debug, diagnosis, post silicon validation, in-field maintenance, etc. The IEEE Std. 1687 (IJTAG) facilitates efficient access to these on-chip instruments using a special scan cell known as Segment Insertion Bit (SIB). Concomitantly, it provides a covert channel for potential intruders to gain unauthorized access to these embedded instruments and thus extract confidential data such as FPGA firmware, secret keys, etc. Thus, it is quite imperative to restrict access to embedded instruments. Various techniques are present in the literature for enhancing the security of IJTAG network. However, securing the test infrastructure at the cost of complex hardware resources is not always a feasible solution.In this paper, a new mechanism to secure the IJTAG network which is based on a new Inherently Secure SIB (ISSIB) is proposed. The proposed technique makes use of an LFSR that is formed using the update cell of the ISSIBs. The proposed scheme is simple to implement, highly scalable and provides high level of security against unauthorized access. In addition to that, the proposed scheme preserves the conventional IJTAG features and has negligible area overhead.

The modern-day SoCs have various instruments and proprietary data embedded on chip for test, diagnosis, post-silicon debug, in-field health monitoring, authentication, counterfeit detection, etc. The testing infrastructure such as IEEE Std. 1687 (IJTAG) is incorporated into the ICs for flexible access to these on-chip instruments. However, this standard can be illegitimately used by malicious users for instigating side-channel attacks. In order to improve the security of the IJTAG network, a secure access protocol based on Chip ID, access software and Locking SIB (LSIB) has been proposed. Although this protocol elevates the security of the IJTAG network, in recent works, it has been shown that the secure access protocol is vulnerable to machine learning attack and differential analysis attack. In this work, a new secure access protocol is proposed which is built over the existing secure access protocol. The proposed protocol uses multiple templates which are selected randomly for embedding the key bits. It is shown that the proposed protocol can mitigate the efficacy of machine learning attack and differential analysis attack significantly. Moreover, it is simple to implement and incurs a marginal overhead in terms of area.

The IEEE Std 1687 (IJT AG) provides enhanced access to the on-chip test instruments, which are included on the chip for test, post-silicon debug, in field maintenance, and diagnosis purposes. Although the on-chip instruments access provides data and features explicitly for test and debug, these features are misused by the malicious user to access sensitive data such as encryption keys, Chip-IDs, etc. Hence, it is desired to limit the access to sensitive on-chip instruments via IJT AG network. One of the various schemes proposed to mitigate the vulnerability of the IJT AG network is to use a secure access protocol, which is based on LSIB, Chip-ID, and licensed access software.In this paper, the detailed security analysis is performed on IJT AG, it is shown that the secure access protocol technique is vulnerable to differential analysis attack. It can be used to break the secure communication between the board and the licensed access software and thus, the sensitive on-chip test instruments can be accessed illegitimately. It is shown that our proposed algorithm can recover the template used for secure communication within a fraction of a second.

The IEEE 1687 standard, which is commonly used for efficient access of on-chip instruments, could be exploited by an intruder and thus needs to be secured. One of the techniques to alleviate the vulnerability of 1687 network is to use a secure access protocol that is based on licensed access software, Chip ID and locking SIB. A licensed access software is generally used to gain control of the embedded instruments and use them as per requirement.

In recent decennium, hardware security has gained a lot of attention due to different types of attacks being launched, such as IP theft, reverse engineering, counterfeiting, etc. The critical testing infrastructure incorporated into ICs is very popular among attackers to mount side-channel attacks. The IEEE standard 1687 (IJTAG) is one such testing infrastructure that is the focus of attackers these days. To secure access to the IJTAG network, various techniques based on Locking SIB (LSIB) have been proposed. One such very effective technique makes use of Security Linear Feedback Shift Register (SLFSR) along with LSIB. The SLFSR obfuscates the scan chain information from the attacker and hence makes the brute-force attack against LSIB ineffective.In this work, it is shown that the SLFSR based Locking SIB is vulnerable to side-channel attacks. A power analysis attack along with known-plaintext attack is used to determine the IJTAG network structure. First, the known-plaintext attack is used to retrieve the SLFSR design information. This information is further used along with power analysis attack to determine the exact length of the scan chain which in turn breaks the whole security scheme. Further, a countermeasure is proposed to prevent the aforementioned hybrid attack.

Today’s integrated circuits contain a large number and variety of embedded instruments that support testing, infield monitoring, post-silicon validation, etc. The IEEE Std. 1687 (IJTAG) provides efficient access to these embedded instruments by dynamically reconfiguring the IJTAG network. At the same time, it opens a backdoor for malicious users to steal sensitive information. Hence, access to embedded instruments through IJTAG must be restricted/secured. Various techniques have been proposed to prevent unauthorized access to the IJTAG network. One such very effective technique that improves the security of IJTAG network is a secure access protocol that uses licensed access software, Locking SIB (LSIB) and Chip ID. Although this technique is simple to implement and is very effective against scan attacks; however, it does not consider the power analysis attack.In this study, it is demonstrated that the security of the secure access protocol technique could be easily breached using a power analysis side-channel attack. The attack leads to unauthorized access to the embedded instruments which in turn could be used for various malicious purposes. Moreover, a countermeasure that mitigates the efficacy of power analysis attack significantly is proposed. It incurs a minimal area overhead and can be easily integrated into the existing secure access protocol.

Scan design-for-test (DfT) feature can be exploited as a side channel to break a cryptographic chip. The stringent test and diagnosis requirements of present-day complex system-on-chip (SoC) make use of the scan DfT feature unavoidable. However, being a threat to cryptographic chips, it needs to be secured against the scan-based side-channel attacks. In this paper, we propose a simple yet effective technique to prevent scan attack on Advanced Encryption Standard (AES) cryptographic chip. The proposed technique restricts the user from applying any random inputs at the plain-text inputs. To use the scan feature the plain-text inputs must be forced to a constant all-0 or all-1 value throughout the test session. Because of this feature, there is no possibility of mounting any differential scan attack. The proposed technique is simple to implement and does not have any impact on test coverage.

High-performance requirements are forcing circuits to have lower combinational depth. At lower depth, degradation of performance can be significant due to multiplexer present in scan flip flop during functional mode. Therefore, exclusion of multiplexer from functional path has been a crucial factor for performance. Furthermore, newer technology nodes are continuously introduced to meet the demand of high-performance system on chips. However, variations, such as environmental variation (temperature) and aging variation (negative bias temperature instability) etc., affect temporal reliability significantly in recent technology nodes. Adding pessimistic timing margin to ensure the reliable working of a circuit under worst case can cause performance as well as power loss. In this paper, we propose an in-situ error prediction monitor with scan-in capability. The proposed cell uses extra master latch. During test mode, slave latch gets scan-in data from extra master latch whereas during functional mode this extra latch helps in error prediction. The proposed cell design adheres to traditional test generation and application. The detailed simulation demonstrates the effectiveness of the design.

Scan-based side-channel attacks have been gaining a prominence among the malicious attackers. The unprotected scan chains are extremely vulnerable and could be exploited to extract the secret information from a security chip such as an Advanced Encryption Standard (AES) cryptochip. To protect the secret information from being hacked it is utmost necessary to redesign the scan chain with security features. In this paper, we propose a secure scan architecture aiming at the protection of AES cryptochips against scan-based attacks. The proposed idea is based on the principle of test pattern encryption. The major contribution of our architecture is area efficiency and its security features without hampering test, diagnose, and debug capability of the original scan chain. The experimental results and security analysis shows the efficacy of proposed design.

Test and diagnosis requirements has made the use of scan design unavoidable for present day highly complex circuits. However, scan design can be exploited to retrieve the secret information stored on a crypto chip by mounting scan based side channel attack. The scan design poses a threat to the security of crypto chips as it gives the user the capability to control/observe the circuit state. In this paper, we propose a technique to secure the scan design that can effectively defend the crypto chips against scan based side-channel attacks. To use the scan architecture the user first needs to supply the test authorization key. Once the user is authorized, the conventional test sequence can be started. Furthermore, the proposed technique allows using the original test set without any test time and test data overhead. In addition to that, the proposed technique leaves the debug capability intact and has a marginal area overhead.

Almost every complex circuit today employs scan-based Design-for-Testability (DFT) architecture to enhance controllability and observability for every flip-flop in the design, thereby improve the testability. However, the DFT structure can also be exploited to mount side-channel attacks to retrieve the secret key stored in a cryptographic chip, thus compromising its security. In this paper, we propose a new secure scan test architecture which isolates the encryption key whenever the cryptographic chip is switched to test mode. The encryption key remains isolated during the whole scan test process. It also clears the last functional states of the security sensitive scan cells as soon as the scan test mode is activated. The proposed secure scan test approach is capable of exercising all kinds of conventional stuck-at and timing test. The proposed approach has minimal hardware overhead and it is capable of preventing existing scan-based side channel attacks.

Scan based diagnosis plays a critical role in yield enhancement of sub-nanometer technology based chips. However, the scan chain itself can be subject to defects due to the large logic circuitry associated with it which constitute a significant fraction of total chip area. In some cases, it has been observed that scan chain failures may account for 30% to 50% of chip failures. Hence, scan chain testing and diagnosis has become very crucial in recent years. In this paper, we propose a hardware-assisted low cost and low complexity scan chain diagnosis technique. The proposed technique is very simple in operation and provides maximum resolution for stuck-at fault diagnosis.

Over the years, serial scan design has became the defacto Design for Testability (DFT) technique. The ease of testing and high test coverage has made it to gain wide spread industrial acceptance. However, there are associated penalties with serial scan. These penalties include performance degradation, test data volume, test application time, and test power dissipation. The performance overhead of scan design is due to the scan multiplexers added to the inputs of every flip-flop. In today's very high speed designs with minimum possible combinational depth, the performance degradation caused by scan multiplexer has became magnified. Hence to maintain the circuit performance the timing overhead of scan design must be addressed. In this paper we propose a new scan flip-flop design that eliminates the performance overhead of serial scan. The proposed design removes the scan multiplexer off the functional path. The proposed design can help in improving the functional frequency of performance critical designs. Furthermore, the proposed design can be used as a common scan flip-flop in mixed mode scan test wherein it can be used as a serial scan cell as well as random access scan RAS) cell.

The demand for high performance system-on-chips (SoC) in communication and computing has been growing continuously. To meet the performance goals, very aggressive circuit design techniques such as the use of smallest possible logic depth are being practiced. Replacement of normal flip-flops with scan flip-flops adds an additional multiplexer delay to critical path. Furthermore as the combinational depth decreases, the performance degradation caused by scan multiplexer delay become more critical. Elimination of the scan multiplexer delay off the functional path has become crucial in maintaining the circuit performance. In this work we propose a new transistor level scan cell design to eliminate the scan multiplexer off the functional path. The proposed scan cell uses separate master latch for functional and test mode where as the slave latch is same in both the modes. Our proposed scan flip-flop fully comply with the conventional test flow. Post layout experimental results justify the effectiveness of the proposed scan cell design in eliminating the performance penalty of scan, and thus in improving the timing performance of integrated circuits.