Multi-tenant FPGAs, in which 3rd parties have partial access to the FPGA fabric, are a rising usage trend in cloud and reconfigurable SoCs. This gives rise to new types of attacks in FPGAs, as shown in recent studies. These attacks can operate on the electrical level through the common power delivery network, making them very hard to isolate. Thus, software-controlled FPGA configuration can be exploited to insert hardware trojans, impacting the security of the entire system. The attacks can be separated into fault and side-channel attacks to either actively manipulate a system or quietly extract secret information. In this paper, we show the first attempt of countermeasures against these voltage fluctuation based attacks, by analyzing FPGA bitstreams for malicious logic, basically implementing an FPGA antivirus. We provide a way to check bitstreams for potentially malicious structures, by extending a combination of commercial and open-source tools.

This article describes how one can perform fault attacks in a shared field-programmable gate array system and thereby steal the secrets of the other users.

The state-of-the-art test infrastructure security is based on the assumption of preventing access to the sensitive information and the (publicly) accessible outputs or test infrastructure subset are supposed to not leak any secret information. In addition, for achieving functional safety requirements, the on-chip test infrastructure is re-used in-field and cannot be completely disabled after manufacturing test phase. Therefore, the access to the scan chains or similar test access ports which can lead to sensitive information needs to be restricted or encrypted to guarantee the security of the test infrastructure. However, in this work we show that having access to (small delay) test results on insensitive (public) outputs can in fact reveal secret data. Using real hardware, we have performed template attacks using the results of delay testing on the output of cryptographic circuits and were able to retrieve the key with very few test inputs. This template attack requires only a few random patterns on the victim device, which could be different from the device used for template building. In addition, the attack is also resilient against runtime variation and noise, as well as inaccuracies and down-sampling of delay testing measurements.

The security of cloud field-programmable gate arrays (FPGAs) faces challenges from untrusted users attempting fault and side-channel attacks through malicious circuit configurations. Fault injection attacks can result in denial of service, disrupting functionality or leaking secret information. This threat is further amplified in multi-tenancy scenarios. Detecting such threats before loading onto the FPGA is crucial, but existing methods face difficulty identifying sophisticated attacks. We present MaliGNNoma, a machine learning-based solution that accurately identifies malicious FPGA configurations. Serving as a netlist scanning mechanism, it can be employed by cloud service providers as an initial security layer within a necessary multi-tiered security system. By leveraging the inherent graph representation of FPGA netlists, MaliGNNoma employs a graph neural network (GNN) to learn distinctive malicious features, surpassing current approaches. To enhance transparency, MaliGNNoma utilizes a parameterized explainer for the GNN, labeling the FPGA configuration and pinpointing the sub-circuit responsible for the malicious classification. Through extensive experimentation on the ZCU102 board with a Xilinx UltraScale+ FPGA, we validate the effectiveness of MaliGNNoma in detecting malicious configurations, including sophisticated attacks, such as those based on benign modules, like cryptography accelerators. MaliGNNoma achieves a classification accuracy and precision of 98.24% and 97.88%, respectively, surpassing state-of-the-art. We compare MaliGNNoma with five state-of-the-art scanning methods, revealing that not all attack vectors detected by MaliGNNoma are recognized by existing solutions, further emphasizing its effectiveness. Additionally, we make MaliGNNoma and its associated dataset publicly available.