Recently, FPGA-accelerated cloud has emerged as a new computing environment. The inclusion of FPGAs in the cloud has created new security risks, some of which are due to circuits exercising excessive switching activity. These power-wasting tenants can cause timing faults in the collocated circuits or a denial-of-service attack by resetting the host FPGA. In this work, we present the idea of populating the FPGA with voltage sensors based on ring oscillators, to continuously monitor the core voltage fluctuations across the entire FPGA. To implement the sensors, we do not lock any FPGA resources; instead, we infiltrate the sensors undercover, by taking advantage of the logic and the routing resources unused by the tenants. Additionally, we infiltrate the sensors into the FPGA circuits after their implementation, but before their deployment on the cloud; the tenants are thus neither aware nor affected by our voltage monitoring system. Finally, we devise a novel metric that takes the sensor measurements to quantify the power wasting activity in the FPGA clock regions where the sensors are infiltrated. We use VTR benchmarks and a Xilinx Virtex-7 FPGA to test the feasibility of our approach. Experimental results demonstrate that, using the undercover voltage sensors and our novel metric, one can accurately locate the source of the malicious power-wasting activity.

This paper presents an extension to PathFinder FPGA routing algorithm, which enables it to deliver FPGA designs free from risks of crosstalk attacks. Crosstalk side-channel attacks are a real threat in large designs assembled from various IPs, where some IPs are provided by trusted and some by untrusted sources. It suffices that a ring-oscillator based sensor is conveniently routed next to a signal that carries secret information (for instance, a cryptographic key), for this information to possibly get leaked. To address this security concern, we apply several different strategies and evaluate them on benchmark circuits from Verilog-to-Routing tool suite. Our experiments show that, for a quite conservative scenario where 10-20% of all design nets are carrying sensitive information, the crosstalk-attack-aware router ensures that no information leaks at a very small penalty: 1.58-7.69% increase in minimum routing channel width and 0.12-1.18% increase in critical path delay, on average. In comparison, in an AES-128 cryptographic core, less than 5% of nets carry the key or the intermediate state values of interest to an attacker, making it highly likely that the overhead for obtaining a secure design is, in practice, even smaller.

Field-programmable gate arrays (FPGAs) are, like CPUs, susceptible to side-channel information leakage and covert communication. The malleability of FPGAs enables users to create and control physical effects, and sense and measure the consequences. With FPGAs becoming integrated into the cloud, a range of hardware-and software-based attacks may be waiting to be discovered. In this survey, we focus on physical channels used for side-channel attacks or covert communication. Physical channels are those that exist due to the physical properties of FPGAs, for example: power consumption, temperature, or electromagnetic emission. We include the most recent demonstrations of malicious or unintended use of physical channels in remote and/or shared FPGAs, propose taxonomies, compare the efficiency and feasibility of the attacks, and discuss challenges in preventing them.