Closing Leaks

Abstract

This paper presents an extension to PathFinder FPGA routing algorithm, which enables it to deliver FPGA designs free from risks of crosstalk attacks. Crosstalk side-channel attacks are a real threat in large designs assembled from various IPs, where some IPs are provided by trusted and some by untrusted sources. It suffices that a ring-oscillator based sensor is conveniently routed next to a signal that carries secret information (for instance, a cryptographic key), for this information to possibly get leaked. To address this security concern, we apply several different strategies and evaluate them on benchmark circuits from Verilog-to-Routing tool suite. Our experiments show that, for a quite conservative scenario where 10-20% of all design nets are carrying sensitive information, the crosstalk-attack-aware router ensures that no information leaks at a very small penalty: 1.58-7.69% increase in minimum routing channel width and 0.12-1.18% increase in critical path delay, on average. In comparison, in an AES-128 cryptographic core, less than 5% of nets carry the key or the intermediate state values of interest to an attacker, making it highly likely that the overhead for obtaining a secure design is, in practice, even smaller. CCS CONCEPTS • Security and privacy → Side-channel analysis and countermeasures; • Hardware → Reconfigurable logic and FPGAs.

Emulating Covert Data Transmission on Heterogeneous SoCs

“…A related approach was used by [Ram+18] to mount an attack on an AES core on a Cyclone IV FPGA. A potential countermeasure for these attacks was later presented by [SMS20], who proposed routing strategies to mitigate the risks of cross-talk attacks by isolating sensitive nets from other components. Most recently, [BL23] studied the characteristics of frequency-based covert channels in modern SoC-FPGA platforms.…”

Electrical-Level Attacks on CPUs, FPGAs, and GPUs: Survey and Implications in the Heterogeneous Era

“…Luo et al developped HILL, a hardware isolation framework, which places security-critical nets in the center of a core, routes them without using the long wires and isolates them from other FPGA cores [127]. Seifoori et al improved the FPGA compilation to ensure that the post place and route designs are protected by construction, i.e., that no untrusted signal is routed close to a security-critical net [194].…”