UCloD: Small Clock Delays to Mitigate Remote Power Analysis Attacks

Cryptographic systems can potentially suffer from various attacks which are a consequence of vulnearability of side channel information to analysis attacks. The nature of digital circuits is prone to electromagnetic and power analysis (EMA and PA) attacks. Interconnects in cryptographic circuits emanate information through electromagnetic signals which can be exploited using EMA. Complementary Metal Oxide Semiconductor (CMOS) circuits are vulnearable to leak of computational information through leakage and dynamic power consumption. Dynamic power consumption of cryptographic engines is a rich source to sink in the data under process. The hardware implementation of cryptographic algorithms undermine the security of encrypted system against non brute-force-attacks. The attackers collect and analyse the leakage information of cryptographic circuits to detect the secrete key. The parameters sensitivity of the device and circuits make the cryptographic engines vulnearable to fault injection and inherent inconsistency of the circuits. Dynamic and static power comprise two major components of power consumption of digital circuits. Both power components vary with data under process. This exhibits power consumption has data dependency in digital circuits. To make noisy power profile, various countermeasures have been proposed against Differential Power Analysis (DPA) attacks. In this research, false glitch cells is proposed to work as a countermeasure to generate random transitions and power spikes to scramble power profile. The mathematical foundation of security implications of false glitch cells against Correlation Power Analysis (CPA) attacks is investigated. Moreoever, the security efficiency of utilizing false glitch cells is verified with different metrics.

The rapid advancement of cloud computing has facilitated the widespread integration of field-programmable gate arrays (FPGAs) into cloud servers to accelerate computing processes. To reduce costs, cloud service providers aim to promote multi-tenant sharing of a single FPGA. In multi-tenant environments, tenants share the power distribution network (PDN), which introduces potential security vulnerabilities. Malicious tenants can conduct remote power analysis attacks by deploying on-chip voltage sensors to detect voltage fluctuations in the PDN. Previous research has focused on enhancing the flexibility and stealthiness of sensors, while insufficient attention has been paid to optimizing sensor parameters for accurate power measurement. This work introduces a phase tuning method for voltage sensors in remote power analysis attacks on AES. The experimental results demonstrate that adjusting the sampling phase enhances the performance of correlation power analysis (CPA) attacks. On average, this method reduces the number of power traces required for CPA attacks by 43.1% and improves the average ranking of correct subkeys by 1.968×. The work reveals novel security threats in multi-tenant FPGAs and contributes to advancing cloud FPGA security research.

Aimed at improving the resistance against power analysis attacks, a systematic and architectural design approach for multicore processors is proposed in this article and is demonstrated in an eight-core prototype platform with low performance overhead and hardware cost. In order to introduce randomness in both the time dimension and the amplitude dimension and make realignment extremely difficult, the proposed multicore platform leverages several methods together, such as random task scheduling (RTS), random insertion of operations (RIO), and frequency and phase randomization (FPR). Moreover, a power state monitoring and control (PSMC) scheme is proposed to defend against power analysis attacks by keeping enough background noises. A test chip of the proposed multicore processor is fabricated in Taiwan Semiconductor Manufacturing Company (TSMC) 65-nm CMOS LP technology and can operate at up to 800 MHz with a 1.2-V supply. The Advanced Encryption Standard (AES) algorithm with these randomization methods is implemented on the processor. Measurement results show that the correlation power analysis (CPA) attacks and the power analysis attacks based on convolutional neural networks (CNNs) are unsuccessful even with 2 000 000 power traces when all the countermeasures are used.

Field-programmable gate arrays (FPGAs) deployed on commercial cloud services are increasingly gaining popularity due to the cost and compute benefits offered by them. Recent studies have discovered security threats than can be launched remotely on FPGAs that share the logic fabric between trusted and untrusted parties, posing a danger to designs deployed on cloud FPGAs. With remote power analysis (RPA) attacks, an attacker aims to deduce secret information present on a remote FPGA by deploying an on-chip sensor on the FPGA logic fabric. Information captured with the on-chip sensor is transferred off the chip for analysis and existing on-chip sensors demand a significant amount of bandwidth for this task as a result of their wider output bit width. However, attackers are often left with the only option of using a covert communication channel and the bandwidth of such channels is generally limited. This paper proposes a novel area-efficient on-chip power sensor named PPWM that integrates a logic design outputting a pulse whose width is modulated by the power consumption of the FPGA. This pulse is used to clear a flip-flop selectively and asynchronously, and the single-bit output of the flip-flop is used to perform an RPA attack. This paper demonstrates the possibility of successfully recovering a 128-bit Advanced Encryption Standard (AES) key within 16,000 power traces while consuming just 25% of the bandwidth when compared to the state of the art. Moreover, this paper assesses the threat posed by the proposed PPWM to remote FPGAs including those that are deployed on cloud services.

Smart cards, such as credit cards and cash cards, protect confidential information using cryptographic circuits. Since cryptographic circuits protect confidential information, various attacks often target cryptographic circuits. To attack cryptographic circuits, a method called side-channel attacks has been reported. Side-channel attacks reveal cipher keys by intentionally mixing faults in a cryptographic circuit or by measuring the power consumption of a cryptographic circuit during its operation. A method using a back-check system was reported as a typical countermeasure of the advanced encryption standard (AES) against a fault analysis attack which uses a cryptogram with faults and a correct cryptogram. This study proposes a new power analysis method against a countermeasure with the back-check system. The proposed method utilizes the circuit structure of back-check system for the analysis. To our knowledge, this is the first power analysis attack against countermeasure of fault analysis attack. Experiments using a LSI prove the validity of the proposed method.

Emerging technologies such as Spin-transfer torque magnetic random-access memory (STT-MRAM) are considered potential candidates for implementing low-power, high density storage systems. The vulnerability of such nonvolatile memory (NVM) based cryptosystems to standard side-channel attacks must be thoroughly assessed before deploying them in practice. In this paper, we outline a generic Correlation Power Analysis (CPA) attack strategy against STT-MRAM based cryptographic designs using a new power model. In our proposed attack methodology, an adversary exploits the power consumption patterns during the write operation of an STT-MRAM based cryptographic implementation to successfully retrieve the secret key. In order to validate our proposed attack technique, we mounted a CPA attack on MICKEY-128 2.0 stream cipher design consisting of STT-MRAM cells with Magnetic Tunnel Junctions (MTJs) as storage elements. The results of the experiments show that the STT-MRAM based implementation of the cipher circuit is susceptible to standard differential power analysis attack strategy provided a suitable hypothetical power model (such as the one proposed in this paper) is selected. In addition, we also investigated the effectiveness of state-of-the-art side-channel attack countermeasures for MRAMs and found that our proposed scheme is able to break such protected implementations as well.

Advanced Encryption Standard (AES) is the most popular symmetric encryption method, which encrypts streams of data by using symmetric keys. The current preferable AES architectures employ effective methods to achieve two important goals: protection against power analysis attacks and high-throughput. Based on a different architectural point of view, we implement a particular parallel architecture for the latter goal, which is capable of implementing a more efficient pipelining in field-programmable gate array (FPGA). In this regard, all intermediate registers which have a role for unrolling the main loop will be removed. Also, instead of unrolling the main loop of AES algorithm, we implement pipelining structure by replicating nonpipelined AES architectures and using an auto-assigner mechanism for each AES block. By implementing the new pipelined architecture, we achieve two valuable advantages: (a) solving single point of failure problem when one of the replicated parts is faulty and (b) deploying the proposed design as a fault tolerant AES architecture. In addition, we put emphasis on area optimization for all four AES main functions to reduce the overhead associated with AES block replication. The simulation results show that the maximum frequency of our proposed AES architecture is 675.62[Formula: see text]MHz, and for AES128 the throughput is 86.5[Formula: see text]Gbps which is 30.9% better than its closest existing competitor.

Encryption is the primary way for ensuring communication security. The symmetric key method, often known as Advanced Encryption Standard (AES), is a well-known technique in the field of security. AES can be implemented in either software or hardware. In the current study, Field Programmable Gate Arrays (FPGAs) are utilized to implement AES. Number of studies have been done on experiments of AES using FPGAs. Till date, no study has been done on the architectures that are being utilized to implement AES on FPGA. This paper provides an in-depth examination of several hardware implementation of AES on FPGA in terms of through put and performance. This survey article enables the engineers to choose the best architecture of FPGAs to implement AES algorithm in terms of design as per the requirement. The surveyed architectures are sequential, pipelined, iterative, and parallel. Parallel architectures with pipelining between rounds have shown an excellent throughput. Certain improved S-box and key expansion approaches have also been employed by the researchers to reduce the hardware areas.KeywordsAES algorithmAES architecturesPipeline architectureParallel architecture

Small embedded systems, such as using a 16-bit CPU, are required to connect to the Internet. In addition, the systems are required to support encrypted communication. We develop a ubiquitous platform which supports Internet Protocol version 6 (IPv6) and IP Security (IPSec). This paper describes realization of Advanced Encryption Standard (AES) processing controlled by an original compact CPU core for small embedded systems. AES encryption and decryption processing requires CPU capability. AES accelerators for a Field Programmable Gate Array (FPGA) perform high speed execution, furthermore they require the resources of an FPGA. In order to conserve the resources of the FPGA, the basic operations of AES, SubBytes, ShiftRows and MixColumns transformation, are incorporated in each hardware module. The modules are controlled by the original compact CPU core. Moreover, the CPU core is designed for small embedded systems. The CPU core is able to support only instructions used in application software. Using the CPU core, AES processing is accomplished conserving FPGA resources, and is simply designed.

A new Vernier-type time-to-digital converter (TDC) with low resource consumption and medium performance is designed and evaluated in a Xilinx Kintex-7 field programmable gate array (FPGA). The converter requires only one ring oscillator, and its resolution is the period difference between two signals of the oscillation pulse and system clock. The conversion is finished by judging the alignment between the oscillation pulse with either the rising edge or the falling edge of the system clock. The difficulty of this new method is the design of the ring oscillator, which is required to oscillate with a frequency closing to the system clock frequency in any position of FPGA to keep TDC performance less position-dependent. The design of such a ring oscillator is proposed and 28 identical TDCs are implemented in 14 clock regions of the FPGA for performance evaluation. Through the TDC bin width measurement, the average resolution of 28 TDCs is 61.1 ps and the variation of resolution over location is 31.5 ps. Through time-interval measurement, the average time-interval RMS precision in 14 clock regions is 28.9 ps and the corresponding precision variation over location is 8.7 ps. The test results show that the proposed TDC is applicable, in particular to cases that multi-channel capability with medium performance is highly required.

Side channel attack (SCA) requires millions of dynamic power current waveforms in cryptographic VLSI circuits. The capacitor charging modeling captures the time evolution of logical activities in the cryptographic operation of an Advanced Encryption Standard (AES) core and efficiently represents the amount of charges consumed during operation. This approach significantly reduces the complexity of power current simulation, and accomplishes acceleration by a factor of 220 or larger over the traditional transistor-level circuit simulation. The correlated power analysis (CPA) attack against AES cores is successfully simulated with a conventional SPICE simulator, with the models individually derived for 10,000 different cipher texts. The simulation-based SCA efficiently evaluates the vulnerability of AES cores in a variety of logical realizations as well as in different technology nodes.

Cryptographic devices with the Advanced Encryption Standard (AES) encryption algorithm are vulnerable to side channel attack, in particular, differential power analysis (DPA). Differential power analysis can be used to reveal the secret key in AES by monitoring the power consumption of the internal circuit and applying statistical processing. In this paper, an evaluation of power analysis attacks of six different AES Sbox designs, namely sum of product (SOP), product of sum (POS), table lookup (TBL), composite field (CF), positive polarity Reed-Miller (PPRM) and 3 stages PPRM, is presented. Comparison of the different AES Sbox implementations in terms of size, performance and SNR analysis is also performed. The results show that the composite field Sbox design is more resistant to attack and smaller than other Sbox designs but operates at a slower speed. This paper also presents a Random Clock mechanism that can be used to increase the resistance of the AES composite field Sbox design to power analysis attack by reducing the overall SNR by 78%.

The rapid adoption of heterogeneous computing has driven the integration of Field Programmable Gate Arrays (FPGAs) into cloud datacenters and flexible System-on-Chips (SoCs). This paper shows that the integrated FPGA introduces a new security vulnerability by enabling software-based power side-channel attacks without physical proximity to a target system. We first demonstrate that an on-chip power monitor can be built on a modern FPGA using ring oscillators (ROs), and characterize its ability to observe the power consumption of other modules on the FPGA or the SoC. Then, we show that the RO-based FPGA power monitor can be used for a successful power analysis attack on an RSA cryptomodule on the same FPGA. Additionally, we show that the FPGA-based power monitor can observe the power consumption of a CPU on the same SoC, and demonstrate that the FPGA-to-CPU power side-channel attack can break timing-channel protection for a RSA program running on a CPU. This work introduces and demonstrates remote power side-channel attacks using an FPGA, showing that the common assumption that power side-channel attacks require specialized equipment and physical access to the victim hardware is not true for systems with an integrated FPGA.

In current countermeasure design trends against differential power analysis (DPA), security at gate level is required in addition to the security algorithm. Several dual-rail pre-charge logics (DPL) have been proposed to achieve this goal. Designs using ASIC can attain this goal owing to its backend design restrictions on placement and routing. However, implementing these designs on field programmable gate arrays (FPGA) without information leakage is still a problem because of the difficulty involved in the restrictions on placement and routing on FPGA. This article describes our novel masked dual-rail pre-charged memory approach, called “intra-masking dual-rail memory (IMDRM) on LUT”, and its implementation on FPGA for Side-Channel Attack-resistant (SCA-resistant) AES. In the proposed design, all unsafe nodes, such as unmasking and masking, and parts of dual-rail memory with unsafe buses (buses that are not masked) are packed into a single LUT. This makes them balanced and independent of the placement and routing tools. Inputs and outputs of all LUTs are masked, and so can be considered safe signals. Several LUTs can be combined to create a safe SBox. The design is independent of the cryptographic algorithm, and hence, it can be applied to available cryptographic standards such as DES or AES as well as future standards. It requires no special placement or route constraints in its implementation. A correlation power analysis (CPA) attack on 1,000,000 traces of AES implementation on FPGA showed that the secret information is well protected against first-order side-channel attacks. Even though the number of LUTs used for memory in this implementation is seven times greater than that of the conventional unprotected single-rail memory table-lookup AES and three times greater than the implementation based on a composite field, it requires a smaller number of LUTs than all other advanced SCA-resistant implementations such as the wave dynamic differential logic, masked dual-rail pre-charge logic, and threshold.

The principle of tapped-delay line (TDL) style field programmable gate array (FPGA)-based time-to-digital converters (TDC) requires finer delay granularity for higher time resolution. Given a tapped delay line constructed with carry chains in an FPGA, it is desirable to find a solution subdividing the intrinsic delay elements further, so that the TDC can achieve a time resolution beyond its cell delay. In this paper, after exploring the available logic resource in Xilinx Kintex UltraScale FPGA, we propose a dual-sampling method to have the TDL status sampled twice. The effect of the new method is equivalent to double the number of taps in the delay line, therefore a significant improvement in time resolution should present. Two TDC channels have been implemented in a Kintex UltraScale FPGA and the effectiveness of the new method is investigated. For fixed time intervals in the range from 0 to 440 ns, the average time resolutions measured by the two TDC channels are respectively 3.9 ps with the dual-sampling method and 5.8 ps by the conventional single-sampling method. In addition, the TDC design maintains advantages of multichannel capability and high measurement throughput in our previous design. Every part of TDC, including dual-sampling, code conversion and on-line calibration could run at 500 MHz clock frequency.