Trust in FPGA-accelerated Cloud Computing

Abstract

Platforms combining Central Processing Systems (CPUs) with Field Programmable Gate Arrays (FPGAs) have become popular, as they promise high performance with energy efficiency. This is the result of the combination of FPGA accelerators tuned to the application, with the CPU providing the programming flexibility. Unfortunately, the security of these new platforms has received little attention: The classic software security assumption that hardware is immutable no longer holds. It is expected that attack surfaces will expand and threats will evolve, hence the trust models, and security solutions should be prepared. The attacker model should be enhanced and consider the following three basic entities as the source of threats: applications run by users, accelerators designed by third-party developers, and the cloud service providers enabling the computation on their platforms. In our work, we review current trust models and existing security assumptions and point out their shortcomings. We survey existing research that target secure remote FPGA configuration, the protection of intellectual property, and secure shared use of FPGAs. When combined, these are the foundations to build a solution for secure use of FPGAs in the cloud. In addition to analysing the existing research, we provide discussions on how to improve it and disclose various concerns that have not been addressed yet.

A Survey of Trusted Computing Solutions Using FPGAs

“…Additionally, surveys are explicitly related to the security concerns of using FPGAs in the cloud, focusing, for instance, on authentication and information security questions concerning the different types of attacks that can occur in cloud computing [6], [36], [43]. Furthermore, in recent years cloud infrastructure and operational challenges related to finding the right abstraction for FPGAs have led to security and trust problems and, consequently, works such as [15], [44] make vulnerability and scalability comparisons concerning trusted platform module (TPM) and Trusted Cryptography Module (TCM). Finally, TEE to protect cloud/edge on Internet of Things (IoT) applications can be found in [45].…”

“…And, on the other hand, to discuss the state-ofthe-art in providing trusted execution with FPGAs and the opportunities novel TEE-enabled applications bring to the use of FPGA accelerators for computing. There have been several earlier surveys on the relationship between FPGAs and security [15], and what we provide with this short, timely survey is the additional exploration of the emerging applications of the last five years in the cloud and the edge. Of course, to understand the challenges at hand, we provide an overview of some of the topics already addressed in previous surveys.…”

GreyConE: Greybox Fuzzing + Concolic Execution Guided Test Generation for High Level Designs

“…Moreover, the adoption of HLS introduces a vulnerability where attackers can clandestinely insert bug functionalities, such as hardware trojans, at a higher abstraction level within the design. On cloud-based FPGAs, trojans pose significant risks, potentially leaking sensitive information, inducing malfunctions in hardware design, tampering with computations or data, or maliciously altering underlying hardware [22,29,56]. Techniques like those described in [50] have been developed to detect trojans in FPGA designs at the IP and synthesis levels.…”

“…Vulnerabilities within third party HLS IPs might arise during the design phase, presenting similarities to security challenges encountered in untrusted electronics supply chains and the insertion of Trojans in pre-silicon hardware. Security researchers have proposed numerous ways to test and validate cloud-based IPs [6,7,56,64].…”

Electrical-Level Attacks on CPUs, FPGAs, and GPUs: Survey and Implications in the Heterogeneous Era

“…We examine RowHammer, fault injection, and SCA attacks. Unlike other surveys, which focus on only one compute unit, one exploit type, or one threat model [15,158,179,188,211,232,233,237], we include in our examination all three computing units and take into consideration the heterogeneous system architecture and deployment models.…”