FPGA-Based Remote Power Side-Channel Attacks

## Overview Marcel, an undergraduate at Cornell working with advisor Professor Ed Saw, presents research on remote power side-channel attacks enabled by FPGA integration in modern systems. The work is timely given the prevalence of FPGAs in cloud infrastructure (Microsoft Project Catapult, Amazon EC2 F1 instances) and proposals to share FPGAs among multiple users, creating attack surface where untrusted users can exploit circuit-level vulnerabilities.

## Key Topics

**FPGA Vulnerabilities & Ring Oscillators** The research leverages a fundamental physical property: power consumption causes voltage drops in the power distribution network (through IR and di/dt phenomena), which degrades signal propagation speed through CMOS logic. Ring oscillators—simple circuits of looped inverters and NAND gates—oscillate at frequencies that slow under high power consumption. By connecting ring oscillator outputs to up-counters and measuring counter values after fixed time intervals, attackers can digitize propagation delays as power measurements. The researchers validated this on a Xilinx 7020 SoC, implementing 20 ring oscillators and 16,000 power virus circuit instances, confirming linear correlation between enabled power viruses and oscillation frequency reduction.

**FPGA-to-FPGA Attacks** The team implemented a 1024-bit RSA cryptographic engine using square-multiply algorithm. The algorithm contains a conditional branch triggering two multipliers when true (high power) or one when false (lower power). Power traces via ring oscillators revealed both individual RSA rounds and bit values, enabling Simple Power Analysis (SPA) attacks. Testing on 10,000 1024-bit keys across three scenarios showed: - Baseline (full placement/routing control): 3.7 traces needed on average - Physical isolation via unused logic buffers: 8.9 traces - No placement/routing control (RTL-only): 11.4 traces All scenarios remained highly practical for key recovery.

**FPGA-to-CPU Attacks** FPGA system-on-chip devices integrate hardened CPU (typically ARM-based) and reprogrammable FPGA fabric on the same silicon die, often sharing a single voltage regulator. This exposes CPU power consumption to FPGA observation. The researchers demonstrated this by implementing RSA square-multiply in software with constant-time mitigations on one CPU core, while an attacker controls another CPU core and FPGA logic. The shared voltage regulator leaked the protected computation's power signature, and timing information also leaked through observable CPU activity—circumventing constant-time countermeasures. Concurrent work demonstrated similar attacks on AES using delay-line-based power monitors and crosstalk-based techniques.

## Countermeasures & Limitations

The researchers examined three potential defenses: 1. **Masking/hiding power traces**: Adds significant overhead, especially problematic for data center performance requirements 2. **Netlist/bitstream analysis**: Computationally expensive and incomplete—ring oscillators and delay lines have legitimate uses (physically unclonable functions, address chains) 3. **Preventing FPGA sharing**: Wastes hardware capacity and does not address the risk of untrusted third-party IP cores within single designs

## Implications & Open Questions

The work threatens: - SGX enclaves and isolated execution environments on integrated FPGA systems - Process identification attacks on virtualized systems - Security of upcoming Intel Xeon chips with embedded FPGAs - Mobile devices exploring FPGA integration

The researchers conclude that FPGA fabric enables multiple on-chip power monitors accessible remotely via software, enabling side-channel and covert-channel attacks across FPGA-to-FPGA, FPGA-to-CPU boundaries, and potentially to other components. Substantially more work is needed to secure FPGA-integrated systems against these threats.