Loading...
Citations
Abstract
Industry trends are moving toward chiplets as a replacement for monolithic fabrication. A chiplet is a separately-produced silicon die that when packaged together with other chiplets on a silicon interposer creates a system-on-chip (SoC). Chiplets bring about many benefits: they enable IP reuse, allow for heterogeneous integration, and provide the ability to leverage cost-appropriate process nodes, all while decreasing cost and improving manufacturing yield. Yet, creating systems from separately produced components also brings many new security risks to consider, such as the possibility of die-swapping, physical tampering, and probing, which differ greatly from the threat model of a single-die system. As a new technology coming to market, security questions surrounding chiplets still need to be answered. In this dissertation, we evaluate some of the commonly discussed security threats that chiplets face and provide mitigations for them.
Initially, we study a new type of FPGA time-to-digital converter (TDC) sensor for voltage monitoring and side-channel analysis. The sensor described relies on dynamic phase shifting of two clocks and repeated sampling to increase its resolution by 560x and achieve a sub-cycle sampling time. We demonstrate its capabilities by reconstructing the sub-cycle fluctuations in the supply voltage of an FPGA caused by a large number of power wasters activating at the same time during a power attack.
In the second part of this dissertation, we adapt this new sensor to realize a delay-based physically unclonable function (PUF). The PUF derives its uniqueness from the variations in delays of interposer wires routing signals between neighboring chiplets. We find that the output of the PUF provides a unique and reliable fingerprint that can be used to authenticate systems, verify their integrity, and provide active protection against physical tampering and probing. We test our PUF at scale using Amazon’s Elastic Compute Cloud F1 instances and perform analysis to pinpoint the source of its entropy.
Finally, in the last part, we conduct the first documented probing attack against a Xilinx VU9P chiplet-based FPGA. Using the Hamamatsu PHEMOS-X laser probing microscope we employ Electro-Optical Frequency Mapping (EOFM) to locate the interconnect drivers on the FPGA and then follow up with Electro-Optical Probing (EOP) to read out the data they are transmitting. Our findings indicate that probing chiplet interfaces requires significantly less effort than probing internal nodes, thereby highlighting a unique vulnerability of chiplets relative to monolithic integrated circuits (ICs). Furthermore, we deploy two delay sensors, one based on dynamic phase shifting and one that utilizes a TDC, in an attempt to defend against contactless probing. We, however, find that despite being capable of detecting laser probes, delay-based sensors do not offer adequate protection as the change in wire delay is too small to be distinguishable from noise and changes due to localized heating. In lieu, we offer a way of masking bus data to prevent waveform integration and hence data readout.
Type
Dissertation (5 Years Campus Access Only)
Date
2025-02
Publisher
Degree
Advisors
License
Attribution 4.0 International
License
http://creativecommons.org/licenses/by/4.0/
Research Projects
Organizational Units
Journal Issue
Embargo Lift Date
2026-02-01