Temperature-based covert channel in FPGA systems

This paper reports the temperature-based covert communication channel implemented in FPGA system. The channel enables bidirectional transmission and exchange of an arbitrary bit stream between two, electrically separated parts of the FPGA circuit during its normal operation. Transmission to and from the FPGA device is also reported. Transmitter and receiver modules are based on ring-oscillator which utilize 60 and 51 look-up tables respectively. The proof of concept was implemented in the Xilinx Spartan-IIE device and allows for transmission speed of 1/8 bit/s between FPGA and external transceiver. Internal communication is faster and allows to transmit up to 1 bit per second.

[1]  Luis Parrilla,et al.  Ring oscillators as thermal sensors in FPGAs: Experiments in low voltage , 2010, 2010 VI Southern Programmable Logic Conference (SPL).

[2]  Paul C. Kocher,et al.  Differential Power Analysis , 1999, CRYPTO.

[3]  Mark McLean,et al.  FPGA-BASED SINGLE CHIP CRYPTOGRAPHIC SOLUTION ( U ) , 2007 .

[4]  Ken Eguro,et al.  FPGA side-channel receivers , 2011, FPGA '11.

[5]  Jörn-Marc Schmidt.  Differential Fault Analysis Final Report , 2008 .

[6]  Butler W. Lampson,et al.  A note on the confinement problem , 1973, CACM.

[7]  Simmons,et al.  The Subliminal Channel and Digital Signatures , 2022 .

[8]  Markus G. Kuhn,et al.  Optical time-domain eavesdropping risks of CRT displays , 2002, Proceedings 2002 IEEE Symposium on Security and Privacy.

[9]  Sebastian Zander,et al.  An Improved Clock-skew Measurement Technique for Revealing Hidden Services , 2008, USENIX Security Symposium.

[10]  Tom Kean,et al.  Verifying the authenticity of chip designs with the DesignTag system , 2008, 2008 IEEE International Workshop on Hardware-Oriented Security and Trust.

[11]  Moti Yung,et al.  A Subliminal Channel in Secret Block Ciphers , 2004, Selected Areas in Cryptography.

[12]  Eduardo I. Boemo,et al.  Thermal monitoring on FPGAs using ring-oscillators , 1997, FPL.

[13]  Gang Wang,et al.  Moats and Drawbridges: An Isolation Primitive for Reconfigurable Hardware Based Systems , 2007, 2007 IEEE Symposium on Security and Privacy (SP '07).

[14]  Einar Snekkenes,et al.  A wireless covert channel on smart cards , 2006 .

[15]  Joseph Zambreno,et al.  A case study in hardware Trojan design and implementation , 2011, International Journal of Information Security.

[16]  David Naccache,et al.  Temperature Attacks , 2009, IEEE Security & Privacy.

[17]  Raheem A. Beyah,et al.  An 802.11 MAC layer covert channel , 2012, Wirel. Commun. Mob. Comput..