Multi-tenant Field Programmable Gate Arrays (FP-GAs) have been widely integrated into cloud and edge computing environments to save hardware costs. Unfortunately, shared FPGAs among multiple users make the system vulnerable to new security threats. For instance, a voltage-drop attack exploits transient voltage fluctuations on the FPGA power distribution network to cause critical faults. Existing works either check combinatorial loops or utilize numerous on-chip sensors to detect fault attacks. Recent literature shows that some advanced power waster units can bypass combinatorial loop checks and defeat attack localization. To counteract the powerful fault attacks, this work proposes an on-chip sensor placement strategy to detect and localize the source of voltage-drop attacks. An attack mitigation framework integrates the proposed sensor placement strategy and a new assessment metric to improve the sensitivity of attack localization. Our case study shows that the proposed method achieves a 100% success rate in attack localization. Furthermore, experimental results show that the proposed method reduces the localization time by 90% and the number of deployed sensors by 89% over existing works.

Multi-tenant Field-programmable Gate Arrays (FPGAs) in cloud service are vulnerable to remotely exploitable attacks, among which power waster circuit (PWC)-based fault attacks have been demonstrated as a highly feasible one. PWC generates high switching activities and causes a sudden voltage drop in the power distribution network (PDN), resulting in a delay of signal propagation and FPGA malfunction. Existing countermeasures deploy bitstream checking methodologies or deploy numerous on-chip sensors to mitigate voltage-drop attacks. Since new PWCs without combinatorial loops and a multi-source attack are emerging, the current countermeasures lack the ability to mitigate new security challenges in multi-tenant FPGAs. To address these issues, a Signal-slowdown (SS)-based fault attack mitigation (S 2 FAM) method is proposed to detect both combinatorial (ring-oscillator (RO)-based PWC) and non-combinatorial (ring-oscillator Flip-flop (ROFF)-based PWC) loop-based attacks and precisely pinpoint the attack locations. A new calibration technique in S 2 FAM facilitates to identify and remove unstable sensor data, thus significantly reducing false positives. Moreover, the proposed method localizes both the single- and multi-source attacks in the FPGA by utilizing a tenant-level SS ranking (TSSR)-based algorithm. Experimental results show that the proposed method reduces the false alarm by 45.8%, compared to the existing works. Our proposed algorithm for attack localization achieves a 100% success rate and reduces the attack localization area for a multi-source attack by 25.2% than an existing countermeasure. The successful localization is achieved by utilizing our proposed method within 2 \(\mu\) s (200 clock cycles) of attack duration. The proposed signal slowdown metric with the calibration process reduces the number of on-chip sensors by 78% and the localization time by 90.5%, compared to the baseline.

FPGAs are being challenged by various security threats, including reverse engineering attacks, hardware tampering, and side-channel analysis attacks. Although the existing static obfuscation methods can protect FPGA systems from IP piracy and hardware tampering, limited work is available to improve the attack resilience of obfuscation modules. As hardware Trojans are one of the most significant hardware tampering attacks on FPGAs, this work aims for the specific hardware Trojan that attempts to nullify design obfuscation. To address this need, we leverage the advanced function of FPGA CAD tools to propose a Dynamic Partial Reconfiguration enabled Design Obfuscation (DPReDO) method. Our method partially modifies the FPGA bitstream at runtime to remove the sabotaged obfuscation variant, thus offering enhanced attack resilience against hardware Trojans. Experimental results based on ISCAS and ITC-99 benchmark circuits show that the DPReDO method reduces the Trojan hit rate by up to 80% over existing static obfuscation with less than 3% hardware overhead. To test the practical feasibility of the proposed countermeasure, we further apply DPReDO to an FPGA-accelerated computation engine for a financial application. Compared to static obfuscation, the proposed DPReDO only incurs 2.6% and 1.2% more FPGA LUTs and slices, respectively.