High-Confidence Remote Power Analysis on Heterogeneous SoCs

In recent years, significant advances have been made in side-channel analysis, particularly in the design of attack methodologies targeting SoC-FPGAs. These devices have become increasingly popular in cloud data centers thanks to their flexibility and efficiency. As a result, there has been a growing number of proposals for sharing FPGA fabrics among multiple users in cloud environments. However, even when logical isolation is used as a protective measure for each tenant, the presence of multiple tenants in the FPGA environment raises significant concerns about potential security threats. Recent works have revealed the possibility of power side-channel attacks being executed in a cloud-FPGA environment, even without direct physical access to the platform. These attacks can be carried out by a malicious user, leveraging delay sensors implemented using internal FPGA resources. These sensors have the ability to monitor the power consumption of a circuit, thus giving malicious user insights into the internal operations of the SoC-FPGA and potentially enabling the extraction of sensitive information. The primary challenge for successful remote power analysis lies in accurately cutting and aligning power traces. Secondary digital channels with trigger information are typically used for this purpose. This paper presents a novel method that simplifies the conditions necessary for a remote power attack. The approach mitigates the need to connect digital triggers to the remote sensor, thereby reducing the complexity of the attack setup. To validate the efficacy of the proposed method, a successful key recovery was performed on a hardware implementation of an AES cipher.