FPGA-Based Remote Power Side-Channel Attacks

This post introduces a power side-channel attack on FPGAs and cloud computing.

Field Programmable Gate Arrays (FPGAs) have been widely adopted as hardware accelerators, as it allows end users to customize their own integrated circuits for specific tasks. Cloud computing vendors such as Amazon lease FPGAs to customers, since FPGAs can be virtualized and shared among users. This results in the fact that circuits belonging to multiple users may co-resides on one physical FPGA, which makes side-channel attacks possible.

However, even if circuits from different users co-resides on the same FPGA board, they are physically partitioned with a “fence” made of unused configurable logic blocks. This prohibits one malicious user to directly steal secrets from victim’s circuit on the same FPGA. A noticeable observation is, a common power supply is shared with all circuits on the same FPGA.  The activities of one single circuit will be reflected in the voltage from the power supply and can be sensed by other circuits. [1] introduced a novel method which takes advantage of this fact and conducts a side-channel attack on RSA encryption process.

In the thread model, the adversary has no physical proximity to a target system and cannot measure its physical properties. However, the adversary is allowed to control the behavior of part of the logic gates on that same FPGA where the victim system resides.

Heavy computation task generally leads to high switching activities of CMOS. High switching activities lead to transient voltage drops of the power supply of the FPGA. In other words, if one of the circuits reside on the FPGA has intensive computation tasks, the result will be a voltage drop of the power supply. This voltage drop can be observed by other circuits, and this fact may be utilized by an adversary.

In order to gather voltage data, an adversary can put a Ring Oscillator on the system. A ring oscillator generates a square wave, whose frequency is determined by the latency of logic gates. Generally, the higher the latency, the lower the frequency. The gate latency is affected by the applied voltage. In other words, the frequency is inversely proportional to the applied voltage. 

A counter is connected to the output of the RO and is incremented by the rising edges. Another counter is triggered by the system clock, whose frequency is known to the adversary. The values of two counters are compared occasionally to derive the average frequency of the RO in one period.

Till now, the adversary can observe the change of voltage in the power supply in a given time range. A case study is presented to illustrate how to conduct a side-channel attack.

Encrypting a message using RSA requires the computation of a large modular exponentiation, which is computationally expensive due to the large operands, and inefficient to be performed in CPU. A practical approach is to design a hardware accelerator using FPGA to implements the square-and-multiply algorithm, as shown in the following figure.

In the above figure, d represents the secret key. There are two multipliers presented. If i^th bit of d is 1, both two multipliers will work. If i^th bit of d is 0, one multiplier will be idle. Thus, the value of i^th bit of d can be inferred by observing the voltage drop. By repeating this process, an adversary can get the entire secret key.

The novelty of this paper is that it introduced a power side-channel vulnerability that beneath the integration of cloud computing and FPGA. It is particularly important as it does not require an adversary to have physical proximity to the victim system, which is practical as the prevalence of cloud computing nowadays.