High-Speed Ring Oscillator based Sensors for Remote Side-Channel Attacks on FPGAs

FPGAs have been widely adopted in cloud datacenters and System-on-Chip for hardware acceleration purposes during the past few years. For flexibility and efficiency reasons, cloud FPGA fabrics are likely to be shared between multiple users. Despite the logical isolation suggested to protect each tenant, multi-user FPGA environment raises crucial questions about the potential security threats that it may represent. Recently, a series of papers demonstrated that a malicious user could be able to use its rented logic to perform remote side-channel and fault attacks on other user assets located inside the fabric or in the surrounding chips. In this paper, we present a novel implementation method for ring oscillator based voltage sensors that enables runtime supply voltage fluctuation measurement. Considering a multi-user FPGA cloud scenario, we evaluate our sensor performances for side-channel purposes by performing CPA attacks against a hardware AES module instantiated within the same FPGA fabric. Then, we compare our results with existing voltage sensors and also demonstrate that, when calibrated, our sensors can provide results similar to traditional electromagnetic side-channel setups.