This paper presents a novel covert timing channel (CTC) that enables a malicious entity to exfiltrate data from a benign cloud FPGA user without requiring dedicated outgoing messages from the cloud FPGA, minimizing the detection risk by both the victim and the cloud service provider. The proposed CTC exploits the handshake signals of the Advanced eXtensible Interface (AXI) protocol and interpacket delay of the Internet to establish the CTC from a cloud FieldProgrammable Gate Array (FPGA) to an off-cloud computer. This paper analyzes the bit-error rate (BER) of the AXI-based CTC under varying conditions and demonstrates its effectiveness in truly enabling remote power analysis attacks on cloud services, such as Amazon Web Services Elastic Compute Cloud (AWS EC2). The proposed CTC achieves a BER as low as 0.01988%.

Recent research demonstrates that utilizing signal jitter to exploit cryptographic circuits has emerged as a critical side-channel vulnerability. The jitter-based side-channel analysis (JitSCA) attack measures signal jitter emanating from cryptographic circuits using time-to-digital converters (TDCs), potentially demonstrating the ability to conduct a remote attack. This paper proposes JitFilt, the first countermeasure to mitigate JitSCA attacks. The JitFilt constructs signal jitter filters using Field Programmable Gate Array (FPGA) mixed mode clock managers (MMCMs), phase-locked loops (PLLs), and IDELAY components to reduce signal jitter.We demonstrate the proposed JitFilt countermeasure on a Digilent ZedBoard FPGA platform. We validate the efficacy of JitFilt’s ability to safeguard cryptographic circuits against JitSCA attacks using Advanced Encryption Standard (AES) circuits. Our results show that the PLL-based clock filter implementation (JitFilt-PLL) demonstrates the highest protection against JitSCA attacks and protects the secret key for up to five million traces. At the same time, an unprotected AES encryption setup would reveal the secret key within 30,000 encryptions, demonstrating over 166× protection.

Power consumption as a side channel has garnered significant attention in security research. Traditional power attacks, also referred to as power analysis attacks, necessitated physical access to target devices to measure power consumption fluctuations for disclosing sensitive information. Recent developments, however, have revealed that field programmable gate arrays (FPGAs) in remote settings and cloud services are vulnerable to remote power analysis (RPA) attacks, avoiding the need for physical access. Understanding evolving threats and sensor methodologies is crucial for the development of robust defense strategies. Thus, this paper discusses two stealthy on-chip sensors, the Voltage-Induced Time Interval Sensor (VITI) and the Power to Pulse Width Modulation Sensor (PPWM), offering effective means for conducting RPA attacks.

Field Programmable Gate Arrays (FPGAs) are increasingly ubiquitous. FPGAs enable hardware acceleration and reconfigurability. Any security breach or attack on critical computations occurring on an FPGA can lead to devastating consequences. Side-channel attacks have the ability to reveal secret information, such as secret keys from cryptographic circuits running on FPGAs. Power dissipation (PA), Electromagnetic (EM) radiation, fault injection (FI) and remote power dissipation (RPA) attacks are the most compelling and noninvasive side-channel attacks demonstrated on FPGAs. This paper discusses two PA attack countermeasures (QuadSeal and RFTC) and one RPA attack countermeasure (UCloD) in detail to protect FPGAs.

Side channel analysis attacks employ the emanated side channel information to deduce the secret keys from cryptographic implementations by analyzing the power traces during execution or scrutinizing faulty outputs. To be effective, a countermeasure must remove or conceal as many as possible side channels. However, many of the countermeasures against side channel attacks are applied independently. In this article, the authors present a novel countermeasure (referred to as QuadSeal ) against Power Analysis Attacks and Electromagentic Fault Injection Attacks (FIAs), which is an extension of the work proposed in Reference [27]. The proposed solution relies on algorithmically balancing both Hamming distances and Hamming weights (where the bit transitions on the registers and gates are balanced, and the total number of 1s and 0s are balanced) by the use of four identical circuits with differing inputs and modified SubByte tables. By randomly rotating the four encryptions, the system is protected against variations, path imbalances, and aging effects. After generating the ciphertext, the output of each circuit is compared against each other to detect any fault injections or to correct the faulty ciphertext to gain reliability. The proposed countermeasure allows components to be switched off to save power or to run four executions in parallel for high performance when resistance against power analysis attacks is not of high priority, which is not available with the existing countermeasures (except software based where source code can be changed). The proposed countermeasure is implemented for Advanced Encryption Standard (AES) and tested against Correlation Power Analysis and Mutual Information Attacks attacks (for up to a million traces), and none of the secret keys was found even after one million power traces (the unprotected AES circuit is vulnerable for power analysis attacks within 5,000 power traces). A detection circuit (referred to as C-FIA circuit) is operated using the algorithmic redundancy presented in four circuits of QuadSeal to mitigate Electromagnetic Fault Injection Attacks. Using Synopsys PrimeTime, we measured the power dissipation of QuadSeal registers and XOR gates to test the effectiveness of Quadruple balancing methodology. We tested the QuadSeal countermeasure with C-FIA circuit against Differential Fault Analysis Attacks up to one million traces; no bytes of the secret key were found. This is the smallest known circuit that is capable of withstanding power-based side channel attacks when electromagnetic injection attack resistance, process variations, path imbalances, and aging effects are considered.

Field-Programmable Gate Arrays (FPGAs) provide a cutting-edge platform for meeting the performance, cost, dependability, and flexibility requirements of on-board data processing in mission-critical and safety applications. However, commercial off-the-shelf SRAM-based FPGAs are susceptible to radiation-induced Single Event Upsets (SEUs). The detection and mitigation of SEUs is, therefore of paramount significance. SEU mitigation techniques such as Triple Modular Redundancy (TMR) and configuration scrubbing are well known. However, these techniques either provide high resource overheads or utilize resources that are themselves susceptible to SEUs. In this work, we propose a Lightweight and Fully Testable SEU Mitigation system–LFTSM that combines high-speed Xilinx FPGA internal configuration repair mechanism with a robust external scrubber in processor cores, targeting SEUs in SRAM-based Xilinx SoC FPGAs (Zynq). The internal repair mechanism corrects single-bit upsets and notifies external scrubber when multi-bit upsets are detected. Multi-bit upsets are classified and repaired by the external scrubber. Our proposed LFTSM system aims to achieve reliability in resource-intensive FPGA application systems providing minimal resource utilization with less than 1% resource overheads (on XC7Z020 FPGA) and the widest fault coverage. Our system provides the smallest resource utilization in comparison to other solutions in the literature and offers full testing control in compliance with Automotive Safety Integrity Level (ASIL); a risk classification standard defined by the ISO 26262. Our solution neither requires the usage of external memories nor third-party tools. We implemented the LFTSM system on Xilinx Zynq SoC (with XC7Z020 FPGA). We validated the fault detection efficiencies of our design using fault injection testing with complete control over the number and locations of error injections in the configuration memory. For the XC7Z020 device, LFTSM scans all configuration bits in multiple microseconds, detects upsets within 8ms and then corrects single-bit and multi-bit upsets in further few milliseconds. We successfully integrated and tested the proposed LFTSM system with the industrial resource-hungry application systems for automotive.

Random execution time-based countermeasures against power analysis attacks have reduced resource overheads when compared to balancing power dissipation and masking countermeasures. The previous countermeasures on randomization use either a small number of clock frequencies or delays to randomize the execution. This paper presents a novel random frequency countermeasure (referred to as RFTC) using the dynamic reconfiguration ability of clock managers of Field-Programmable Gate Arrays -- FPGAs (such as Xilinx Mixed-Mode Clock Manager -- MMCM) which can change the frequency of operation at runtime. We show for the first time how Advanced Encryption Standard (AES) block cipher algorithm can be executed using randomly selected clock frequencies (amongst thousands of frequencies carefully chosen) generated within the FPGA to mitigate power analysis attack vulnerabilities. To test the effectiveness of the proposed clock randomization, Correlation Power analysis (CPA) attacks are performed on the collected power traces. Preprocessing methods, such as Dynamic Time Warping (DTW), Principal Component Analysis (PCA) and Fast Fourier Transform (FFT), based power analysis attacks are performed on the collected traces to test the effective removal of random execution. Compared to the state of the art, where there were 83 distinct finishing times for each encryption, the method described in this paper can have more than 60,000 distinct finishing times for each encryption, making it resistant against power analysis attacks when preprocessed and demonstrated to be secure up to four million traces.

Power-based side channel attacks are effective in revealing the secret keys of cryptographic algorithm implementations running on soft processor systems. This paper, for the first time, proposes a clock random execution methodology (referred to as SCRIP) to execute a soft processor core and most of the components (some components cannot be executed with a random clock frequency). An open source soft processor system (LowRISC which is based on the RISC-V Instruction Set Architecture) has been executed with the proposed SCRIP clock random execution methodology. Power analysis attacks (including preprocessing techniques to remove the effects of random execution) were carried out against the SCRIP LowRISC soft processor implementation to test the effects of random clock execution. SCRIP LowRISC implementation is shown to be secure for up to 300,000 encryptions, while the LowRISC implementation without SCRIP revealed the secret key within 1,000 encryptions. The result of information leakage test shows that the secret key cannot be recovered with 99.999% confidence level. Compared to other soft core processor countermeasures, SCRIP LowRISC implementation has the smallest complete soft processor system with 1.04× resource overhead (the smallest hardware masking countermeasure, which is applied to only the ALU of a RISC-V processor has 1.59× resource overhead, and the smallest balancing countermeasure soft processor, with the countermeasure applied only to the ALU and the memory, required 1.15× area overhead) where the security against power analysis attacks is applied to most components of the processor (including ALU, caches, Block RAM, Block RAM controller, bus interconnect and SD card interface). SCRIP LowRISC implementation is the first soft processor with a random execution-based countermeasure to withstand preprocessing methods (such as power trace alignment and noise filtering) which remove the effects of random execution.

Power based side-channel attacks attempt to obtain the secret key from implementations of cryptographic algorithms, such as Advanced Encryption Standard (AES), by analyzing the power traces during execution. Such attacks employ statistical methods to find correlations of power traces with parts of the secret key. In order to be effective, a countermeasure must remove or conceal such a signature. Previous countermeasures have either removed dynamic power signatures or leakage power signatures, but have not demonstrated effectiveness against both. In this paper, for the first time, we propose a balance and rotate technique for block cipher based algorithms and demonstrate it on an AES circuitry to remove the signature of the secret key from both the static and dynamic components of the power traces and further demonstrate that the countermeasure can withstand the path imbalances and process variation effects. Our solution, relies on algorithmically balancing Hamming distances and Hamming weights (where the bit transitions on the registers and gates are balanced, and the total number of 1s and 0s are balanced) by the use of four identical circuits with differing inputs and modified SubByte tables. By randomly rotating the four encryptions, the system is protected against variations, path imbalances and aging effects. When resistance against power analysis attacks is not of high priority, the proposed countermeasure allows components to be switched off to save power, or to run four executions in parallel for high performance. The proposed countermeasure is implemented for AES and tested against CPA and MIA attacks (for up to a million traces) and none of the secret keys were found even after one million power traces (unprotected AES circuit revealed the secret key within 5,000 power traces). This is the smallest known circuit which is capable of withstanding power based side-channel attacks when variations, path imbalances and aging effects are considered.

Advanced Encryption Standard (AES) is arguably the most popular symmetric block cipher algorithm. The commonly used mode of operation in AES is the Electronic Codebook (ECB) mode. In the past, side channel attacks (including power analysis based attacks) have been shown to be effective in breaking the secret keys used with AES, while AES is operating in the ECB mode. AES defines a number of advanced modes (namely Cipher Block Chaining - CBC, Cipher Feedback - CFB, Output Feedback - OFB, and Counter - CTR) of operations that are built on top of the EBC mode to enhance security via disassociating the encryption function from the plaintext or the secret key used. In this paper, we investigate the vulnerabilities against power analysis based side channel attacks of all such modes of operations, implemented on hardware circuits for low power and high speed embedded systems. Through such an investigation, we show that AES is vulnerable in all modes of operations against Correlation Power Analysis (CPA) attack, one of the strongest power analysis based side channel attacks. We also quantify the level of difficulty in breaking AES in different modes by calculating the number of power traces needed to arrive at the complete secret key. We conclude that the Counter mode of operation provides a balance in between area and power while maintaining adequate resistance for power analysis attacks than when used with other modes of operations. We show that the previous recommendations for the rate of change in the keys and vectors is grossly inadequate, and suggest that it must be changed at least every 210encryptions in CBC mode and 212encryptions in CFB, OFB and CTR modes in order to resist power analysis attacks.

Cache attacks have been described in the literature for over a decade now. Cache attacks are performed remotely by the use of time differences observed due to cache misses and hits, or by the use of power traces either by measuring power or by monitoring the bus between the processor and the memory to monitor the cache activity. In this paper, for the first time we have implemented a fast trace driven cache attack, and incorporated this attack into a flexible framework containing extensible processor(s). This simulator is modifiable and incorporates both Tensilica's [9] processor simulator environment along with DRAMsim, a DRAM simulator. Thus we are able to make changes to processor's instruction set, its cache architecture, and add additional hardware units. On this framework we have implemented a hardware / software countermeasure and shown that it is difficult to differentiate the cache misses for differing encryptions. The processor with the countermeasure is 30% more energy ef ficient, 17% more power efficient and 15% faster and when compared to processor without the countermeasure. The area of the processor with the countermeasure increases by 7.6%.