Power-hammering through Glitch Amplification – Attacks and Mitigation

Abstract

Recent work on FPGA hardware security showed a huge potential risk through powerhammering which uses high switching activity in order to create excessive dynamic power loads. Virtually all present powerhammering attack scenarios are based on some kind of ring oscillators for which mitigation strategies exist. In this paper, we use a different strategy to create excessive dynamic power consumption: glitch amplification. By carefully designing XOR trees, fast switching wires can be implemented that together with driving high fanout nets can draw enough power to crash an FPGA. In addition to the attack (which is crashing an Ultra96 board), we will present a scanner for detecting malicious glitch amplifying FPGA designs.

FPGA-to-CPU Undervolting Attacks

“…Unlike CPUs, FPGAs do not usually have DVFS interfaces. However, using the low-level programmability of FPGAs, researchers have demonstrated how to design and deploy a variety of designs to consume significant amounts of power [6], [7], [13], [14]. The high power consumption results in a voltage drop, which can inject faults, or even reset the entire board [6].…”

“…About the same time, FPGA researchers have found that programming FPGAs with so-called power-wasting circuits, which draw considerable current, can produce notable fluctuations of the supply voltage. The resulting voltage drop may then be leveraged by an adversary to reset the target system [6], [7], or, if carefully controlled, to inject computational faults in the host FPGA [8]- [10].…”

Denial-of-Service on FPGA-based Cloud Infrastructures — Attack and Defense

“…In [LMG + 20] and [MLPK20], the open-source FPGA virus-scanner framework FPGADefender for Xilinx UltraScale+ devices was introduced. The framework retrieves the netlist from a bitstream (via an academic tool BitMan [PHK17]) and scans for a set of pre-defined virus signatures (i.e.…”

“…Glitches in an FPGA design can be created through carefully designed combinatorial logic and its physical implementation. For example, a 6-input XOR can create 6 glitches in a clock cycle leading to a corresponding high dynamic power consumption [MLPK20]. The work in [MLPK20] showed that the vendor power estimator cannot reliably detect power-hammering created through glitch amplification.…”

Securing FPGA Accelerators at the Electrical Level for Multi-tenant Platforms

“…Glitches can be amplified through XOR gates [15], which has the property that any change at the input causes a change at the output. Therefore by adjusting routing delays, it is possible to physically implement an oscillator where the same source of a toggle flip-flop is routed to an XOR with different delays to create glitches that, in turn, are fed back to the toggle flip-flop for creating self-oscillation (Figure 2d).…”