FPGA-Based Remote Power Side-Channel Attacks

TLDR

The rapid adoption of heterogeneous computing has driven the integration of FPGAs into cloud datacenters and flexible SoCs. The paper demonstrates that integrated FPGAs enable remote software‑based power side‑channel attacks, refuting the assumption that such attacks require specialized equipment and physical proximity. The authors build an on‑chip power monitor on a modern FPGA using ring oscillators and show it can observe the power consumption of other FPGA or SoC modules. The RO‑based FPGA power monitor successfully performs power‑analysis attacks on an on‑FPGA RSA module and on a CPU in the same SoC, breaking timing‑channel protection and demonstrating that remote power side‑channel attacks are feasible without physical proximity.

Abstract

The rapid adoption of heterogeneous computing has driven the integration of Field Programmable Gate Arrays (FPGAs) into cloud datacenters and flexible System-on-Chips (SoCs). This paper shows that the integrated FPGA introduces a new security vulnerability by enabling software-based power side-channel attacks without physical proximity to a target system. We first demonstrate that an on-chip power monitor can be built on a modern FPGA using ring oscillators (ROs), and characterize its ability to observe the power consumption of other modules on the FPGA or the SoC. Then, we show that the RO-based FPGA power monitor can be used for a successful power analysis attack on an RSA cryptomodule on the same FPGA. Additionally, we show that the FPGA-based power monitor can observe the power consumption of a CPU on the same SoC, and demonstrate that the FPGA-to-CPU power side-channel attack can break timing-channel protection for a RSA program running on a CPU. This work introduces and demonstrates remote power side-channel attacks using an FPGA, showing that the common assumption that power side-channel attacks require specialized equipment and physical access to the victim hardware is not true for systems with an integrated FPGA.