# US 2019/0318083 A1 · Method and device for detecting a malicious circuit on an integrated circuit

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0318083 A1
- Document ID: US20190318083A1
- Status: Published application
- Kind: A1
- Application number: 16/417,858
- Filed: 2019-05-21
- Published: 2019-10-17
- Earliest claimed: 2018-04-11
- Assignees: NXP B.V.
- Applicants: NXP B.V.
- Inventors: Jan-Peter Schat
- Web page: https://patentgrep.com/patent/US20190318083A1

## CPC

- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/71: to assure secure computing or processing of information
- G01R 31/317: Testing of digital circuits
- G01R 31/31707: {Test strategies (methods for generation of test sequences G01R31/318371)}
- G01R 31/3177: Testing of logic operation, e.g. by logic analysers
- G01R 31/318566: {Comparators; Diagnosing the device under test}
- G06F 11/26: Functional testing
- G06F 11/263: Generation of test inputs, e.g. test vectors, patterns or sequences {; with adaptation of the tested hardware for testability with external testers}
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06F 21/76: in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
- G01R 31/31724: {Test controller, e.g. BIST state machine (for scan test G01R31/318555)}
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G01R: MEASURING ELECTRIC VARIABLES; MEASURING MAGNETIC VARIABLES (indicating correct tuning of resonant circuits H03J3/12)

## Abstract

A method and device for detecting a malicious circuit on an integrated circuit (IC) device is provided. The method includes generating a plurality of test patterns on the IC. A scan test circuit and the plurality of test patterns are used to test don't care bits of a function under test on the integrated circuit. Scan out data from the scan test circuit is provided in response to the plurality of test patterns. The scan out data is stored in a memory on the integrated circuit. The scan out data is monitored over a predetermined time period. If it is determined that a characteristic of the scan out data has changed within the predetermined time period, an indication that a malicious circuit has been detected is output. The device includes circuitry for performing the method in the field.

## Claims

### Claim 1

A method for detecting a malicious circuit on an integrated circuit device, the method comprising:
providing a plurality of test patterns, using a scan test circuit, to test don't care bits of a function under test on the integrated circuit;
outputting scan out data from the scan test circuit in response to the plurality of test patterns;
monitoring the scan out data over a predetermined time period, and determining if a characteristic of the scan out data has changed within the predetermined time period; and
outputting an indication if a malicious circuit has been detected or suspected.

### Claim 2 (depends on 1)

The method of claim 1, wherein the characteristic of the scan out data that is monitored within the predetermined time period further comprises one or more of an average value of the stored scan out data, a correlation of the stored scan out data to the don't care bits, and an autocorrelation of the scan out values over time.

### Claim 3 (depends on 1)

The method of claim 1, wherein the don't care bits of the plurality of test patterns are generated pseudo-randomly.

### Claim 4 (depends on 1)

The method of claim 1, wherein the scan test circuit is a logic built-in self-test (LBIST) circuit.

### Claim 5 (depends on 1)

The method of claim 1, wherein the method is performed by a self-testing circuit on the integrated circuit after production testing and after the integrated circuit has been implemented in a product.

### Claim 6 (depends on 1)

The method of claim 1, wherein the method is performed by a self-testing circuit intermittently to an application running on the integrated circuit after the integrated circuit has been implemented in a product.

### Claim 7 (depends on 1)

The method of claim 1, wherein the function under test is one of a logic function, or mixed-signal function.

### Claim 8 (depends on 1)

The method of claim 1, wherein outputting the indication further comprises disabling functionality of the integrated circuit.

### Claim 9

A method for detecting a malicious circuit on an integrated circuit device, the method comprising:
providing a plurality of test patterns, using a scan test circuit, to test don't care bits of a function under test on the integrated circuit;
outputting scan out data from the scan test circuit in response to the plurality of test patterns;
storing the scan out data in a memory on the integrated circuit;
monitoring the scan out data over a predetermined time period, and determining if a characteristic of the scan out data has changed within the predetermined time period, wherein the characteristic comprises one or more of an average value of the stored scan out data, a correlation of the stored scan out data to don't care bits, and an autocorrelation of the undefined scan out values over time; and
outputting an indication that a malicious circuit has been detected.

### Claim 10 (depends on 9)

The method of claim 9, wherein the don't care bits of the plurality of test patterns are generated pseudo-randomly.

### Claim 11 (depends on 9)

The method of claim 9, wherein the scan test circuit is characterized as being a logic built-in self-test circuit.

### Claim 12 (depends on 9)

The method of claim 9, wherein the method is performed by a self-testing circuit on the integrated circuit after the integrated circuit has been implemented in a product.

### Claim 13 (depends on 9)

The method of claim 9, wherein the method is performed by a self-testing circuit on the integrated circuit intermittently to an application running on the integrated circuit.

### Claim 14 (depends on 9)

The method of claim 9, wherein the function under test is one of a logic function or mixed signal function.

### Claim 15 (depends on 1)

The method of claim 1, wherein outputting the indication further comprises disabling functionality of the integrated circuit.

### Claim 16

A device comprising:
a test pattern generator for providing a plurality of test patterns to test don't care bits of a function under test on the device;
a scan test circuit for providing scan out data in response to the plurality of test patterns;
a memory for storing the scan out data; and
a scan out data monitoring engine coupled to the memory for determining if a characteristic of the scan out data has changed within a predetermined time period, and in response to detecting a change in the scan out data, providing an indication that a malicious circuit has been detected on the device.

### Claim 17 (depends on 16)

The device of claim 16, wherein the characteristic of the scan out data that is monitored within the predetermined time period further comprises one or more of an average value of the stored scan out data, a correlation of the stored scan out data to don't care bits, and an autocorrelation of the undefined scan out values over time.

### Claim 18 (depends on 16)

The device of claim 16, wherein the device comprises one or more integrated circuits.

### Claim 19 (depends on 16)

The device of claim 16, wherein the scan test circuit is characterized as being a logic built-in self-test circuit.

### Claim 20 (depends on 16)

The device of claim 16, wherein the test pattern generator provides a plurality of randomly generated test patterns.