PowerScout: A Security-Oriented Power Delivery Network Modeling Framework for Cross-Domain Side-Channel Analysis

Zhu, Huifeng; Guo, Xiaolong; Jin, Yier; Zhang, Xuan

doi:10.1109/asianhost51057.2020.9358263

Cited by 13 publications

(8 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Regarding the RO enable signal pattern, we found that continuously activating the ROs is ineffective for fault injection. Toggling the activation of the power wasters is necessary to successfully inject faults, which aligns with observations in previous work [18], [22], [28]. Comparing continuous toggling, on one side, with toggling for the first half of the exploit followed by continuous activation in the second half, on the other, we observed that the latter configuration increased the likelihood of the FIFOs resetting.…”

Section: ) Enable Signal Parameterssupporting

confidence: 90%

“…Additionally, instead of AMD FPGAs, we target Intel FPGAs. Our analyses provide novel and detailed insights into undervolting effects on a cloud instance with Intel FPGAs 2 , thus complementing the existing literature focusing on AMD FPGAs [28].…”

mentioning

confidence: 72%

“…The period determines the number of clock cycles of each repetition of the toggling of the signal, and the duty cycle determines the ratio of the period during which the enable signal is high. Controlling the period and the duty cycle is essential as it introduces frequency components that render the voltage drop more significant due to the frequency-dependent PDN impedance [28].…”

Section: B Attacker Designmentioning

confidence: 99%

See 2 more Smart Citations

X-Attack 2.0: The Risk of Power Wasters and Satisfiability Don’t-Care Hardware Trojans to Shared Cloud FPGAs

Mahmoud,

Shokry,

Lenders

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Cloud computing environments increasingly provision field-programmable gate arrays (FPGAs) for their programmability and hardware-level parallelism. While FPGAs are typically used by one tenant at a time, multitenant schemes supporting spatial sharing of cloud FPGA resources have been proposed in the literature. However, the spatial multitenancy of FPGAs opens up new attack surfaces. Investigating potential security threats to multitenant FPGAs is thus essential for better understanding and eventually mitigating the security risks. This work makes a notable step forward by systematically analyzing the combined threat of FPGA power wasters and satisfiability don't-care hardware Trojans in shared cloud FPGAs. We demonstrate a successful remote undervolting attack that activates a hardware Trojan concealed within a victim FPGA design and exploits the payload. The attack is carried out entirely remotely, assuming two spatially colocated FPGA users isolated from one another. The victim user's circuit is infected with a Trojan, triggered by a pair of don't-care signals that never reach the combined trigger condition during regular operation. The adversary, targeting the exploitation of the Trojan, deploys power waster circuits to lower the supply voltage of the FPGA. The assumption is that, under the effect of the lowered voltage, don't-care signals may reach the particular state that triggers the Trojan. We name this exploit X-Attack and demonstrate its feasibility on an embedded FPGA and real-world cloud FPGA instances. Additionally, we study the effects of various attack tuning parameters on the exploit's success. Finally, we discuss potential countermeasures against this security threat and present a lightweight self-calibrating countermeasure. To the best of our knowledge, this is the first work on undervolting-based fault-injection attacks in multitenant FPGAs to demonstrate the attack on commercially available cloud FPGA instances.INDEX TERMS FPGA security, hardware Trojans, multitenancy, timing faults, remote attack I. INTRODUCTION

show abstract

Section: ) Enable Signal Parameterssupporting

confidence: 90%

mentioning

confidence: 72%

Section: B Attacker Designmentioning

confidence: 99%

See 1 more Smart Citation

X-Attack 2.0: The Risk of Power Wasters and Satisfiability Don’t-Care Hardware Trojans to Shared Cloud FPGAs

Mahmoud,

Shokry,

Lenders

et al. 2024

IEEE Access

View full text Add to dashboard Cite

show abstract

“…The duty cycle parameter sets the number of clock cycles, within one attack period, for which the enable signal remains active. As shown in previous work [6], [9], [21], the frequency of the activation signal matters; if it is close to the resonance frequency of the board PDN, the obtained voltage drop is more significant and, hence, fault injection is more likely. Similarly, the duty cycle affects the obtained voltage drop.…”

Section: A Attacker Parameters Sweepmentioning

confidence: 50%

FPGA-to-CPU Undervolting Attacks

Mahmoud

Hussein

Lenders³

et al. 2022

2022 Design, Automation &Amp; Test in Europe Conference &Amp; Exhibition (DATE)

View full text Add to dashboard Cite

FPGAs are proving useful and attractive for many applications, thanks to their hardware reconfigurability, low power, and high-degree of parallelism. As a result, modern embedded systems are often based on systems-on-chip (SoCs), where CPUs and FPGAs share the same die. In this paper, we demonstrate the first undervolting attack in which the FPGA acts as an aggressor while the CPU, residing on the same SoC, is the victim. We show that an adversary can use the FPGA fabric to create a significant supply voltage drop which, in turn, faults the software computation performed by the CPU. Additionally, we show that an attacker can, with an even higher success rate, execute a denial-of-service attack, without any modification of the underlying hardware or the power distribution network. Our work exposes a new electrical-level attack surface, created by tight integration of CPUs and FPGAs in modern SoCs, and incites future research on countermeasures.

show abstract

“…A PDN in a complex PCB design often consists of subnets from several different voltage domains, with voltage regulator modules (VRMs) in each domain to supply the stable voltages, power traces from the VRMs to connect the chip pins, onchip power grids to distribute power locally on the die, and decoupling capacitors to mitigate the voltage fluctuations at various PDN stages [10]. All PDN components are connected across multiple levels (e.g., chip, package, board) of the system and form a tree structure to create multiple voltage domains, each with its own VRMs to drive the local supply voltages [63]. In modern electronic systems, the PDN requires low impedance to provide an adequate supply noise margin, a requirement that makes it sensitive to minute modifications.…”

Section: Introductionmentioning

confidence: 99%

PDNPulse: Sensing PCB Anomaly with the Intrinsic Power Delivery Network

Zhu¹,

Shan²,

Sullivan³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

The ubiquitous presence of printed circuit boards (PCBs) in modern electronic systems and embedded devices makes their integrity a top security concern. To take advantage of the economies of scale, today's PCB design and manufacturing are often performed by suppliers around the globe, exposing them to many security vulnerabilities along the segmented PCB supply chain. Moreover, the increasing complexity of the PCB designs also leaves ample room for numerous sneaky board-level attacks to be implemented throughout each stage of a PCB's lifetime, threatening many electronic devices. In this paper, we propose PDNPulse, a power delivery network (PDN) based PCB anomaly detection framework that can identify a wide spectrum of boardlevel malicious modifications. PDNPulse leverages the fact that the PDN's characteristics are inevitably affected by modifications to the PCB, no matter how minuscule. By detecting changes to the PDN impedance profile and using the Frechet distancebased anomaly detection algorithms, PDNPulse can robustly and successfully discern malicious modifications across the system. Using PDNPulse, we conduct extensive experiments on seven commercial-off-the-shelf PCBs, covering different design scales, different threat models, and seven different anomaly types. The results confirm that PDNPulse creates an effective security asymmetry between attack and defense.

show abstract

PowerScout: A Security-Oriented Power Delivery Network Modeling Framework for Cross-Domain Side-Channel Analysis

Cited by 13 publications

References 14 publications

X-Attack 2.0: The Risk of Power Wasters and Satisfiability Don’t-Care Hardware Trojans to Shared Cloud FPGAs

X-Attack 2.0: The Risk of Power Wasters and Satisfiability Don’t-Care Hardware Trojans to Shared Cloud FPGAs

FPGA-to-CPU Undervolting Attacks

PDNPulse: Sensing PCB Anomaly with the Intrinsic Power Delivery Network

Contact Info

Product

Resources

About