Method and apparatus for enhancing security in and discouraging theft of VLSI and ULSI devices

Claim 2

The format of claim 1 wherein said built-in security mechanism comprises: a controller to control the operation of the security mechanism; a boundary scan port electrically coupled to said controller, said boundary scan port providing an interface between the security mechanism and an external medium; a flash memory electrically coupled to said controller, said flash memory providing the security mechanism with non-volatile storage of predetermined information and data; a set of security registers for providing functional support to said controller, said security registers electrically coupled to said flash memory, said controller and said boundary scan port; and tristate control logic for providing said controller with functional control over the core functional circuit and the output ports of the large scale integrated device, said tristate logic control electrically coupled to said controller, the core functional circuit and output ports of the device.

Claim 3

The format of claim 2 wherein said controller includes combinational logic and state machine flip-flops to interpret commands sent by said external medium, manage said flash memory and said security registers, verify passwords for unlocking the device, supply said external medium with said predetermined data, and control the output ports of the core functional circuit through said tristate logic.

Claim 4

The format of claim 2 wherein said flash memory provides 128 bytes of memory to store said predetermined information and data, each said byte being eight bits wide and having a separate location address, wherein the first byte is location address O and the last byte is location address 127.

Claim 5

A built-in security mechanism for a large scale integrated device, the device having a core functional circuit and output ports, the security mechanism comprising: a controller to control the operation of the security mechanism; a boundary scan port electrically coupled to said controller, said boundary scan port providing an interface between the security mechanism and an external medium; a flash memory electrically coupled to said controller, said flash memory providing the security mechanism with non-volatile storage of predetermined information and data; a set of security registers for providing functional support to said controller, said security registers electrically coupled to said flash memory, said controller and said boundary scan port; and tristate control logic for providing said controller with functional control over the core functional circuit and the output ports of the large scale integrated device, said tristate logic control electrically coupled to said controller and the core functional circuit and output ports of the device to prevent unauthorized use thereof.

Claim 6

The format of claim 5 wherein said controller includes combinational logic and state machine flip-flops to interpret commands sent by said external medium, manage said flash memory and said security registers, verify passwords for unlocking the device, supply said external medium with said predetermined data, and control the output ports of the core functional circuit through said tristate logic.

Claim 7

The format of claim 6 wherein said flash memory provides 128 bytes of memory to store said predetermined information and data, each said byte being eight bits wide and having a separate location address, wherein the first byte is location address O and the last byte is location address 127.

Claim 8

The format of claim 4 or 7, wherein said predetermined information and data includes user identification information. a password, a device serial number. a random security challenge, security session status information, and failure information.

Claim 9

The format of claim 8 wherein said security status information is stored in location address O, said failure information is stored in location addresses 1 and 2, said user identification is stored in location addresses 3-47, said password is stored in location addresses 48-63, said serial number is stored in location addresses 64-95, and said random security challenge is stored in location addresses 96-127.

Claim 10

The format of claim 8 wherein said random security challenge is a test, wherein said test requires said external medium to return a value at the beginning of each power-up of the device to unlock the device.

Claim 11

The format of claim 2 or 5, wherein: said security registers include a security status register, a security command register, a failure threshold register, a failure count register, a device password register, a random challenge register, and a temporary data register; and said boundary scan port is a standard IEEE 1149.1 port.

Claim 13

The method of claim 12 wherein said security mechanism enters into a security session to protect unauthorized access to the device from an external medium.

Claim 14

The method of claim 13 wherein said security session comprises the steps of: a. requesting the external medium to return a password upon each power-up of the device; b. comparing said returned password to a preprogrammed password in said security mechanism to determine if a password match exists therebetween. c. providing said external medium access to the device if said password match exists.

Claim 15

The method of claim 13 wherein said security session comprises the steps of: a. requesting the external medium to return a random challenge value upon each power-up of the device; b. comparing said returned random challenge value to a random challenge value calculated by said security mechanism to determine if a challenge value match exists therebetween. c. providing said external medium access to the device if said challenge value match exists.

Claim 16

The method of claim 15 wherein said random challenge value is a value calculated by both said external medium and said security mechanism from a set of random variables.

Claim 17

The method of claim 13 wherein said security session comprises the steps of: a. requesting the external medium to return a password and a random challenge value upon each power-up of the device; b. comparing said returned random challenge value to a random challenge value calculated by said security mechanism to determine if a challenge value match exists therebetween. c. comparing said returned password to a preprogrammed password in said security mechanism to determine if a password match exists therebetween. d. providing said external medium access to the device if both said challenge value match and said password match exist.

Claim 18

The method of claim 13 wherein said security mechanism enters into a device serial number change session if said external medium passes said security session.

Claim 19

The method of claim 13 wherein said security mechanism enters into a password change session if said external medium passes said security session.

Claim 20

The method of claim 13 wherein said security mechanism enters into a device serial number read session if said external medium passes said security session.

Claim 21

The method of claim 13 wherein said security mechanism enters into a failure threshold change session if said external medium passes said security session.