Pattern Recognization of Instruction-Level Power Noise with Sythesized Sensor Inside FPGA

In a multitenant FPGA, the power noise induced by a victim circuit form a side channel for an attacker on the same FPGA chip to steal the information of the victim. Previous researches are performed on program-level to show how the algorithm type or the key data of a victim can be identified through a synthesized on-chip noise sensor. This paper is focused on the fine-grained waveform of the power noise that correspond to single instructions of the microprocessor. The purpose is to see whether the instruction type can be identified through the synthesized sensor. A MIPS center processor unit (CPU) is designed as the victim. A ring oscillator (RO) based sensor called Flexible-RO is designed as the attacker. Both of them are implemented in a Xilinx Artix-7 xc7a200tfbg676 FPGA. The waveforms of the supply voltage of 37 different instructions are collected. Correlation analysis shows that many instructions have power pattern that are distinguishable from those of other instructions. Power patterns of memory-type instructions are different from the arithmetic and logic instructions. The observation made in this paper indicates that, from the privacy point of view, a remote attacker can easily determine the instruction level details of operation of the victim circuit. The conclusion of the paper helps understanding the bottom mechanism of security issues of the multitenant FPGA.