Reading Between the Dies: Cross-SLR Covert Channels on Multi-Tenant Cloud FPGAs

Abstract

Field-Programmable Gate Arrays (FPGAs) are becoming increasingly available via commercial cloud providers, which currently allocate devices on a per-user basis. As the underlying hardware is often underutilized, several proposals for multi-tenant use of FPGA resources have been brought forth, along with some initial work on security attacks in this setting. Simultaneously, high-end FPGAs are being produced with 2.5D integration of multiple distinct dies, called Super Logic Regions (SLRs), onto the same chip. Although one might expect that physical separation of logic onto separate dies could prevent multitenant attacks, this paper demonstrates for the first time that cross-SLR information leaks based on sensing voltage changes within the FPGA chip are possible, without physical access to or modification of the boards. The cross-SLR covert channel is characterized analytically and experimentally on five Xilinx Virtex UltraScale+ FPGAs, both locally and on the Amazon and Huawei clouds. Several configurations of the source transmitters and the sink receivers are tested, including their locations, types, and sizes. The power-based channel is shown to have a bandwidth upwards of 4.6 Mbps and accuracy of over 97.6%. Consequently, as physical separation of tenants onto separate dies (SLRs) is an insufficient countermeasure against information leaks, hardware-level architectural improvements are necessary to make secure multi-tenant FPGAs on shared clouds a reality.

CPAmap: On the Complexity of Secure FPGA Virtualization, Multi-Tenancy, and Physical Design

“…Moreover, we observed how the layout and organization of the larger fabric further increases the design space and thus the variation in side-channel vulnerability. Modern high-end FPGAs are often composed of multiple dies, where side-channel attacks have been shown to be still possible [GRS19]. However, those multi-die chips add another design space parameter to be considered.…”

Information leakage from FPGA routing and logic elements

“…To overcome this limitation, we can estimate the absolute delay difference ∆d of each RO by accounting for the clock frequency f c and the measurement period 2 t , and adapting an equation derived in previous works [9,10,20]:…”

“…Instead, for static information leakage, we propose that a more fine-grained approach should be preferred which prohibits sharing any CLB resources (logic elements, or routing elements in the CLB's switch matrix), if any of the CLB's inputs are from mutually untrustworthy sources. That said, neither approach prevents information leakage due to dynamic activity when the attacker and victim are: (a) on different dies within the same chip [10], (b) different FP-GAs on the same board [23], or (c) even different boards with a shared power supply [11]. Such attacks require improvements in the voltage regulation circuits, or hiding the useful signal under artificially-introduced random noise.…”

“…The potential information leakage between different users' designs can happen not only due to dynamic activity across the FPGA chip [10], but also because of short-lived static signals when parts of the designs are routed on adjacent wires in the FPGA [7-9, 20, 21]. Moreover, as we show in this paper for the first time, information leaks also occur when these signals are routed through multiplexers in the same Configurable Logic Block (CLB).…”

“…They focus broadly on two types of countermeasures. One set of proposals demands isolating different circuits through physical partitioning, e.g., [14], but physical isolation can lead to poor resource utilization, and still does not prevent information leakage due to dynamic activity, e.g., [10]. The other approaches use design rule checks (DRCs) that prevent long wires in mutually-untrusting designs from being routed next to each other [7-9, 19, 24].…”