Virtual field‐programmable gate array (FPGA) is an emerging technology to put multiple users in the same FPGA fabric with logical isolation. Security researchers have studied new threats in virtual FPGA and proposed attacks on the logical isolation by exploiting analogue natures of FPGA. These attacks use an oscillator comprising a combinatorial loop to have access to the analogue domain using digital components only. Interestingly, the system in the field prohibits a combinatorial loop by a design rule check. In this Letter, the authors study if prohibiting a combinatorial loop is sufficient to thwart the conventional attacks. They negatively answer the question by showing oscillators without a combinatorial loop. They also show how to detect and reject the proposed oscillators by a design rule check.

This paper presents a low-cost distance-spoofing attack on a mmWave Frequency Modulated Continuous Wave (FMCW) radar. It uses only a replica radar chipset and a single compact microcontroller board both in mass production. No expensive and bulky test instrument is required, and hence a low-cost and lightweight attack setup is developed. Even with the limited hardware resource in this setup, the replica radar can be precisely synchronized with the target radar for distance-spoofing capability. A half-chirp modulation scheme enables timing compensation between crystal oscillators on the replica and the target radar boards. A two-step delay insertion scheme precisely controls relative delay difference between two radars at ns-order, and as a result the attacker can manipulate distance measured at target radar with only around ±10m ranging error. This demonstrates potential feasibility of low-cost malicious attack on the commercial FMCW radar as a physical security threat. A countermeasure employing randomchirp modulation is proposed and its security level is evaluated under the proposed attack for secure and safe radar ranging.

No abstract

No abstract

RISC-V is equipped with physical memory protection (PMP) to prevent malicious software from accessing protected memory regions. PMP provides a trusted execution environment (TEE) that isolates secure and insecure applications. In this study, we propose a side-channel-assisted fault-injection attack to bypass isolation based on PMP. The proposed attack scheme involves extracting successful glitch parameters for fault injection from side-channel information under crossdevice conditions. A proof-of-concept TEE compatible with PMP in RISC-V was implemented, and the feasibility and effectiveness of the proposed attack scheme was validated through experiments in TEEs. The results indicate that an attacker can bypass the isolation of the TEE and read data from the protected memory region In addition, we experimentally demonstrate that the proposed attack applies to a real-world TEE, Keystone. Furthermore, we propose a software-based countermeasure that prevents the proposed attack.