This paper presents a novel covert timing channel (CTC) that enables a malicious entity to exfiltrate data from a benign cloud FPGA user without requiring dedicated outgoing messages from the cloud FPGA, minimizing the detection risk by both the victim and the cloud service provider. The proposed CTC exploits the handshake signals of the Advanced eXtensible Interface (AXI) protocol and interpacket delay of the Internet to establish the CTC from a cloud FieldProgrammable Gate Array (FPGA) to an off-cloud computer. This paper analyzes the bit-error rate (BER) of the AXI-based CTC under varying conditions and demonstrates its effectiveness in truly enabling remote power analysis attacks on cloud services, such as Amazon Web Services Elastic Compute Cloud (AWS EC2). The proposed CTC achieves a BER as low as 0.01988%.

Power consumption as a side channel has garnered significant attention in security research. Traditional power attacks, also referred to as power analysis attacks, necessitated physical access to target devices to measure power consumption fluctuations for disclosing sensitive information. Recent developments, however, have revealed that field programmable gate arrays (FPGAs) in remote settings and cloud services are vulnerable to remote power analysis (RPA) attacks, avoiding the need for physical access. Understanding evolving threats and sensor methodologies is crucial for the development of robust defense strategies. Thus, this paper discusses two stealthy on-chip sensors, the Voltage-Induced Time Interval Sensor (VITI) and the Power to Pulse Width Modulation Sensor (PPWM), offering effective means for conducting RPA attacks.

Field Programmable Gate Arrays (FPGAs) are increasingly ubiquitous. FPGAs enable hardware acceleration and reconfigurability. Any security breach or attack on critical computations occurring on an FPGA can lead to devastating consequences. Side-channel attacks have the ability to reveal secret information, such as secret keys from cryptographic circuits running on FPGAs. Power dissipation (PA), Electromagnetic (EM) radiation, fault injection (FI) and remote power dissipation (RPA) attacks are the most compelling and noninvasive side-channel attacks demonstrated on FPGAs. This paper discusses two PA attack countermeasures (QuadSeal and RFTC) and one RPA attack countermeasure (UCloD) in detail to protect FPGAs.