Boosting Scan Chain Security in a White-box through Restricted Pattern Filtering

The scan chain, a fundamental component of Design-for-Test (DfT) in modern integrated circuits (ICs), has long been exploited to inject malicious inputs and leak sensitive information. Existing secure scan techniques collapse under the white-box attack model, where adversaries with full visibility to the netlist model and test data can decipher the scan chain structure and gain arbitrary control over the system. In this paper, we propose a defense mechanism that restricts scan chain access in such adversarial settings while maintaining full support for both production and post-production testing. Our approach enhances the scan chain by incorporating filtering logic that only permits authorized input patterns, thereby reducing its vulnerability to malicious activities. These filters are embedded using a combination of forward and backward feedback paths that create inherent correlations and conflicts among scan cells. The architecture supports a limited set of filter configurations chosen for their balance of filtering strength and fault coverage. Experiments on ISCAS-89 benchmarks demonstrate that the method maintains full fault coverage while blocking most unauthorized patterns, with under 1% area overhead and a 4% increase in test time.