Search

In many reverse engineering efforts, side channels have been utilized to extract both design information and data from integrated circuits. In this paper, a technique is demonstrated to recover data by directly reading idle SRAM cells within an FPGA, without engaging the read circuitry. This is accomplished using photon emission microscopy to capture the photons that are emitted as leakage currents flow from the source to the drain of NMOS transistors within the SRAM cell. Depending on whether a 0 or 1 state is stored in a particular cell, the location of the emitting transistor is different. The read circuity in many integrated circuits cannot be easily activated in a repeatable pattern, thus forming need to access the contents of idle SRAM cells. This was evaluated and refined on a 220 nm process node FPGA. We discuss the physics of photon emission in these devices and the consequences for successful imaging of SRAM contents. Through initial investigations and calculations, we predict that extraction of data from idle SRAM can be conducted on more modern parts. Through an extension of this technique, data such as encryption keys, state information, and restricted variables that would not be accessible through traditional bitstream and firmware reverse engineering efforts can be extracted from the integrated circuit. This information can then be utilized to ensure the integrity of a system, or as a threat to the integrity of the system.

FPGAs are used in many long-life systems that serve mission-critical needs. The supply chain and life-cycle management of these devices have long relied on ensuring adequate controls are in place. In this paper, a technique is presented that provides measurement vectors by determining both characteristics of the supply properties of the FPGA and characteristics of aging of the FPGA. Asynchronous ring oscillators are placed throughout the FPGA, and the measurement of these oscillators is compared to other chips both within a manufacturing lot and between other manufacturing lots. Through these non-invasive measurements, the “health history” of the FPGA can be evaluated and utilized in supply chain decisions before and during system operation.

Design recovery is commonly conducted across many different platforms to gain knowledge about the underlying internals of a system. In this paper, a concept of segmentation and fuzzy matching is introduced to identify IP blocks within a design. Through this process, known IP blocks, especially in optimized ASIC and FPGA designs, can be identified within a netlist. Furthermore, these algorithms are computationally more efficient in comparison to the traditional subgraph isomorphism problem.

The programmable interconnection resources are one aspect that distinguishes FPGAs from other devices. The abundance of these resources in modern devices almost always assures us that the most complex design can be routed. This underutilized resource can be used for other unintended purposes. One such use, explored here, is to concatenate large networks together to form pseudo-equipotential geometric shapes. These shapes can then be evaluated in terms of their ability to radiate (modulated) energy off the chip to a nearby receiver. In this paper, an unconventional method of building such transmitters on an FPGA is proposed. Arbitrary shaped antennas are created using a unique flow involving an experimental router and binary images. An experiment setup is used to measure the performance of the antennas created.

We present and describe Torc - (Tools for Open Reconfigurable Computing) - an open-source infrastructure and tool set, provided entirely as C++ source code and available at http://torc.isi.edu. Torc is suitable for custom research applications, for CAD tool development, and for architecture exploration.The Torc infrastructure can (1) read, write, and manipulate generic netlists - currently EDIF, (2) read, write, and manipulate physical netlists - currently XDL, and indirectly NCD, (3) provide exhaustive wiring and logic information for commercial devices, and (4) read, write, and manipulate bitstream packets (but not configuration frame contents). Torc furthermore provides routing and unpacking tools for full or partial designs, soon to be augmented with BLIF support, and with packing and placing tools.The architectural data for Xilinx devices is generated from non-proprietary XDLRC files, and currently supports 140 devices in 11 families: Virtex, Virtex-E, Virtex-II, Virtex-II Pro, Virtex4, Virtex5, Virtex6, Virtex6L, Spartan3E, Spartan6, and Spartan6L. We believe that Altera architectures and designs could be similarly supported if the necessary data were available, and we have successfully used Torc internally with custom architectures.