Voltage Sensor Implementations for Remote Power Attacks on FPGAs

Abstract

This paper presents a study of two types of on-chip FPGA voltage sensors based on ring oscillators (ROs) and time-to-digital converter (TDCs), respectively. It has previously been shown that these sensors are often used to extract side-channel information from FPGAs without physical access. The performance of the sensors is evaluated in the presence of circuits that deliberately waste power, resulting in localized voltage drops. The effects of FPGA power supply features and sensor sensitivity in detecting voltage drops in an FPGA power distribution network (PDN) are evaluated for Xilinx Artix-7, Zynq 7000, and Zynq UltraScale+ FPGAs. We show that both sensor types are able to detect supply voltage drops, and that their measurements are consistent with each other. Our findings show that TDC-based sensors are more sensitive and can detect voltage drops that are shorter in duration, while RO sensors are easier to implement because calibration is not required. Furthermore, we present a new time-interleaved TDC design that sweeps the sensor phase. The new sensor generates data that can reconstruct voltage transients on the order of tens of picoseconds.

Exploring the Usage of Fast Carry Chains to Implement Multistage Ring Oscillators on FPGAs: Design and Characterization

“…R ING oscillators (ROs) are well established circuits widely adopted as basic building blocks in several applications, ranging from hardware security [1], [2], [3], [4], [5], [6], [7] to ON-chip testing and aging monitoring [8], [9], [10], [11]. An RO is able to generate an oscillatory signal by cascading an odd number of inverting stages, thus resulting in a highly flexible and compact solution compared with other oscillatory sources, such as LC resonators [12], [13].…”

“…An RO is able to generate an oscillatory signal by cascading an odd number of inverting stages, thus resulting in a highly flexible and compact solution compared with other oscillatory sources, such as LC resonators [12], [13]. Such properties are crucial for the abovementioned applications, where ROs are mainly used to measure the effects of manufacturing process variations [1], [2], [3], [4], [5] or to detect performance degradation [7], [8], [9], [10].…”

“…In this regard, several approaches have gained popularity in the last decade. Most common solutions in the literature include physically unclonable function (PUF) for hardware authentication [1], [2], [3], true random number generator (TRNG) on the fly free session keys generation [4], [5], voltage sensors for remote side-channel attacks detection [7], and ON-chip aging estimation circuits [9], [10]. All these methods rely on ROs that have to be efficiently implemented within the FPGA device.…”

“…Although the functionality of an RO is based on a quite simple circuitry, its desired hardware characteristics, and consequently its design, are strongly target application-dependent. Just as an example, ROs used to implement a PUF circuit must be ideally no sensitive to different environmental conditions (e.g., voltage variations) [15], which is exactly the opposite of the behavior expected by a voltage sensor [7]. Often, such designs make use of multiple RO instances, for which ensuring nominally identical frequency behaviors is mandatory [16], [17].…”

“…The above considerations motivate the focus of this work. Furthermore, many previous research works confirm that FPGA-based ROs designed by exploiting lookup table (LUT) primitives require manual P&R, in order to achieve reliable and effective implementations [7], [16], [17], [18], [19]. In addition, due to its circuitry consisting just of chained LUTs and routing resources, the conventional RO design demonstrates poor adaptability to different application requirements and relatively low flexibility in fine-tuning the oscillator behavior.…”