Method and apparatus for enhancing security in and discouraging theft of VLSI and ULSI devices

Claim 2

A large scale integrated device having a core functional circuit and at least one output port, said device comprising: a security mechanism; a controller to control the operation of the security mechanism; a boundary scan port electrically coupled to said controller, said boundary scan port providing an interface between the security mechanism and an external medium; a flash memory electrically coupled to said controller, said flash memory providing the security mechanism with non-volatile storage of predetermined information and data; a set of security registers for providing functional support to said controller, said security registers electrically coupled to said flash memory, said controller and said boundary scan port; and tristate control logic for providing said controller with functional control over the core functional circuit and the output ports of the large scale integrated device, said tristate logic control electrically coupled to said controller, the core functional circuit and output ports of the device.

Claim 3

The device of claim 1 wherein said controller includes combinational logic and state machine flip-flops to interpret commands sent by said external medium, manage said flash memory and said security registers, verify passwords for unlocking the device, supply said external medium with said predetermined data, and control the output ports of the core functional circuit through said tristate logic.

Claim 4

The device of claim 1 wherein said flash memory provides 128 bytes of memory to store said predetermined information and data, each said byte being eight bits wide and having a separate location address, wherein the first byte is location address 0 and the last byte is location address 127.

Claim 5

The device of claim 3 wherein said predetermined information and data includes user identification information, a password, a device serial number, a random security challenge, security session status information, and failure information.

Claim 6

The device of claim 4 wherein said security status information is stored in location address 0, said failure information is stored in location addresses 1 and 2, said user identification is stored in location addresses 3-47, said password is stored in location addresses 48-63, said serial number is stored in location addresses 64-95, and said random security challenge is stored in location addresses 96-127.

Claim 7

The device of claim 4 wherein said random security challenge is a test, wherein said test requires said external medium to return a value at the beginning of each power-up of the device to unlock the device.

Claim 8

The device of claim 1 wherein said security registers include a security status register, a security command register, a failure threshold register, a failure count register, a device password register, a random challenge register, and a temporary data register.

Claim 9

The device of claim 1 wherein said boundary scan port further comprises a test access port controller, an instruction register, an instruction decoder, a device bypass register and a boundary scan register.

Claim 10

A built-in security mechanism for a large scale integrated device, the device having a core functional circuit and output ports, the security mechanism comprising: a controller to control the operation of the security mechanism; a boundary scan port electrically coupled to said controller, said boundary scan port providing an interface between the security mechanism and an external medium; a flash memory electrically coupled to said controller, said flash memory providing the security mechanism with non-volatile storage of predetermined information and data; a set of security registers for providing functional support to said controller, said security registers electrically coupled to said flash memory, said controller and said boundary scan port; and tristate control logic for providing said controller with functional control over the core functional circuit and the output ports of the large scale integrated device, said tristate logic control electrically coupled to said controller and the core functional circuit and output ports of the device to prevent unauthorized use thereof.

Claim 11

A built-in security mechanism for a large scale integrated device, the device having a core functional circuit and output ports, the security mechanism comprising: a controller to control the operation of the security mechanism; a boundary scan port electrically coupled to said controller, said boundary scan port providing an interface between the security mechanism and an external medium; a flash memory electrically coupled to said controller, said flash memory providing the security mechanism with non-volatile storage of predetermined information and data; a set of security registers for providing functional support to said controller, said security registers electrically coupled to said flash memory, said controller and said boundary scan port; and tristate control logic for providing said controller with functional control over the core functional circuit and the output ports of the large scale integrated device, said tristate logic control electrically coupled to said controller and the core functional circuit and output ports of the device to prevent unauthorized use thereof.

Claim 12

The device of claim 9 wherein said controller includes combinational logic and state machine flip-flops to interpret commands sent by said external medium, manage said flash memory and said security registers, verify passwords for unlocking the device, supply said external medium with said predetermined data, and control the output ports of the core functional circuit through said tristate logic.

Claim 13

The device of claim 10 wherein said flash memory provides 128 bytes of memory to store said predetermined information and data, each said byte being eight bits wide and having a separate location address, wherein the first byte is location address 0 and the last byte is location address 127.

Claim 14

The device of claim 11 wherein said predetermined information and data includes user identification information, a password, a device serial number, a random security challenge, security session status information, and failure information.

Claim 15

The device of claim 12 wherein said security status information is stored in location address 0, said failure information is stored in location addresses 1 and 2, said user identification is stored in location addresses 3-47, said password is stored in location addresses 48-63, said serial number is stored in location addresses 64-95, and said random security challenge is stored in location addresses 96-127.

Claim 16

The device of claim 12 wherein said random security challenge is a test, wherein said test requires said external medium to return a value at the beginning of each power-up of the device to unlock the device.

Claim 17

The device of claim 9 wherein said security registers include a security status register, a security command register, a failure threshold register, a failure count register, a device password register, a random challenge register, and a temporary data register.

Claim 18

The device of claim 15 wherein said boundary scan port further comprises a test access port controller, an instruction register, an instruction decoder, a device bypass register and a boundary scan register.

Claim 21

The method of claim 17 wherein said security session comprises the steps of: a. requesting the external medium to return a password upon each power-up of the device; b. comparing said returned password to a preprogrammed password in said security mechanism to determine if a password match exists therebetween. c. providing said external medium access to the device if said password match exists.

Claim 22

The method of claim 17 wherein said security session comprises the steps of: a. requesting the external medium to return a random challenge value upon each power-up of the device; b. comparing said returned random challenge value to a random challenge value calculated by said security mechanism to determine if a challenge value match exists therebetween; c. providing said external medium access to the device if said challenge value match exists.

Claim 23

The method of claim 19 wherein said random challenge value is a value calculated by both said external medium and said security mechanism from a set of random variables.

Claim 24

The method of claim 17 wherein said security session comprises the steps of: a. requesting the external medium to return a password and a random challenge value upon each power-up of the device; b. comparing said returned random challenge value to a random challenge value calculated by said security mechanism to determine if a challenge value match exists therebetween; c. comparing said returned password to a preprogrammed password in said security mechanism to determine if a password match exists therebetween; d. providing said external medium access to the device if both said challenge value match and said password match exist.

Claim 25

The method of claim 17 wherein said security mechanism enters into a device serial number change session if said external medium passes said security session.

Claim 26

The method of claim 17 wherein said security mechanism enters into a password change session if said external medium passes said security session.

Claim 27

The method of claim 17 wherein said security mechanism enters into a device serial number read session if said external medium passes said security session.

Claim 28

The method of claim 17 wherein said security mechanism enters into a failure threshold change session if said external medium passes said security session.