Abstract:Cloud computing environments increasingly provision field-programmable gate arrays (FPGAs) for their programmability and hardware-level parallelism. While FPGAs are typically used by one tenant at a time, multitenant schemes supporting spatial sharing of cloud FPGA resources have been proposed in the literature. However, the spatial multitenancy of FPGAs opens up new attack surfaces. Investigating potential security threats to multitenant FPGAs is thus essential for better understanding and eventually mitigating the security risks. This work makes a notable step forward by systematically analyzing the combined threat of FPGA power wasters and satisfiability don’t-care hardware Trojans in shared cloud FPGAs. We demonstrate a successful remote undervolting attack that activates a hardware Trojan concealed within a victim FPGA design and exploits the payload. The attack is carried out entirely remotely, assuming two spatially colocated FPGA users isolated from one another. The victim user’s circuit is infected with a Trojan, triggered by a pair of don’t-care signals that never reach the combined trigger condition during regular operation. The adversary, targeting the exploitation of the Trojan, deploys power waster circuits to lower the supply voltage of the FPGA. The assumption is that, under the effect of the lowered voltage, don’t-care signals may reach the particular state that triggers the Trojan. We name this exploit X-Attack and demonstrate its feasibility on an embedded FPGA and real-world cloud FPGA instances. Additionally, we study the effects of various attack tuning parameters on the exploit’s success. Finally, we discuss potential countermeasures against this security threat and present a lightweight self-calibrating countermeasure. To the best of our knowledge, this is the first work on undervolting-based fault-injection attacks in multitenant FPGAs to demonstrate the attack on commercially available cloud FPGA instances.

Meta-Scanner: Detecting Fault Attacks via Scanning FPGA Designs Metadata

X-Attack 2.0: The Risk of Power Wasters and Satisfiability Don’t-Care Hardware Trojans to Shared Cloud FPGAs

Mitigating Voltage Attacks in Multi-Tenant FPGAs

Hacking the Fabric: Targeting Partial Reconfiguration for Fault Injection in FPGA Fabrics

Scalable Test Generation to Trigger Rare Targets in High-Level Synthesizable IPs for Cloud FPGAs

Low-cost Design of Stealthy Hardware Trojan for Bit-Level Fault Attacks on Block Ciphers

A Deep Investigation on Stealthy DVFS Fault Injection Attacks at DNN Hardware Accelerators

The State-of-the-art in EDA tools: the Hardware Trojan Confrontation Framework

A Lightweight Multi-Attack CAN Intrusion Detection System on Hybrid FPGAs

Efficient HW/SW Co-design of FPGA Accelerator to Detect Anomaly Attacks in Smart Grids

A CRISPR-Cas-Inspired Mechanism for Detecting Hardware Trojans in FPGA Devices

Power Side-Channel Attacks on BNN Accelerators in Remote FPGAs

Terminator on SkyNet

JustSTART: How to Find an RSA Authentication Bypass on Xilinx UltraScale(+) with Fuzzing

FuCE: Fuzzing+Concolic Execution guided Trojan Detection in Synthesizable Hardware Designs

MUTARCH: Architectural diversity for FPGA device and IP security

FPGA-Patch: Mitigating Remote Side-Channel Attacks on FPGAs using Dynamic Patch Generation

Toward FPGA Security in IoT: A New Detection Technique for Hardware Trojans.

Security and Reliability Evaluation of Countermeasures implemented using High-Level Synthesis

MaliGNNoma: GNN-Based Malicious Circuit Classifier for Secure Cloud FPGAs

SoK: On the Security Challenges and Risks of Multi-Tenant FPGAs in the Cloud