High-Speed Ring Oscillator based Sensors for Remote Side-Channel Attacks on FPGAs

Abstract

FPGAs have been widely adopted in cloud datacenters and System-on-Chip for hardware acceleration purposes during the past few years. For flexibility and efficiency reasons, cloud FPGA fabrics are likely to be shared between multiple users. Despite the logical isolation suggested to protect each tenant, multiuser FPGA environment raises crucial questions about the potential security threats that it may represent. Recently, a series of papers demonstrated that a malicious user could be able to use its rented logic to perform remote sidechannel and fault attacks on other user assets located inside the fabric or in the surrounding chips. In this paper, we present a novel implementation method for ring oscillator based voltage sensors that enables runtime supply voltage fluctuation measurement. Considering a multiuser FPGA cloud scenario, we evaluate our sensor performances for side-channel purposes by performing CPA attacks against a hardware AES module instantiated within the same FPGA fabric. Then, we compare our results with existing voltage sensors and also demonstrate that, when calibrated, our sensors can provide results similar to traditional electromagnetic side-channel setups.

UCloD: Small Clock Delays to Mitigate Remote Power Analysis Attacks

“…Schellenberg et al [13] proposed first RPA attack using TDC sensors to deduce the secret key of an AES circuit. Gravellier et al [15] proposed to use RO based sensors to detect voltage fluctuations.…”

“…These power dissipations are quantized by an oscilloscope or a sensor such as, TDC or RO-based voltage sensor. Authors in [13] and [15] have shown how AES is vulnerable to RPA attack using TDC and RO sensors. Then the adversary builds hypothetical power dissipation, such as hamming weight (counting number of '1's) or hamming distance (counting the number of bit flips), to model what circuit might consume based on input/ output using a guessed key.…”

“…The delay sensor readings will be affected due to such voltage fluctuations. In order to detect these voltage fluctuations, Time to Digital Converters (TDC) [13] and Ring Oscillators (ROs) [15] have been proposed. According to the authors in [15], multiple ROs have to be placed in the FPGA, while a single TDC sensor is able to reveal the secret key of AES [13].…”

“…In order to detect these voltage fluctuations, Time to Digital Converters (TDC) [13] and Ring Oscillators (ROs) [15] have been proposed. According to the authors in [15], multiple ROs have to be placed in the FPGA, while a single TDC sensor is able to reveal the secret key of AES [13]. Thus, we limit our focus to TDC sensors in this paper, since they are smaller and more efficient [16].…”

“…We confirm this reduction on synthetic traces with added white noise, before showing that an attacker is significantly thwarted when implemented on commercial FPGAs with real data for at least up to a million traces. We also carry out RO-based delay sensor attacks (similar to the attack proposed in [15]) to test the efficiency of the proposed UCloD against RObased RPA attacks. The clock delay-based countermeasures proposed in the literature (which we have discussed in the related work section) to prevent PA attacks, use much higher delays to misalign the power dissipation of the secret operation (Figure 1-(B)).…”