Side-Channel Attacks Using On-Chip Reliability Instruments

Abstract

Modern integrated circuits contain extensive on-chip instrumentation—Ring Oscillators (ROs), temperature sensors, voltage monitors, and delay-measurement circuits—originally intended for reliability monitoring and process calibration. The same physical sensitivity that makes these instruments effective sensors also makes them potential side-channel receivers. An adversary who can place or exploit such instrumentation near sensitive logic may be able to recover secret-dependent information without requiring external measurement equipment or physical probing. This threat is relevant across FPGA, ASIC, and SoC platforms, yet the boundary conditions under which on-chip instrumentation can reliably leak key information remain incompletely characterised.

This study uses a Xilinx Artix-7 FPGA as a controllable proof-of-concept platform to examine how key-bit observability degrades as the coupling path between a secret source and an on-chip RO listener is systematically weakened. Three completed experimental families span the coupling continuum from a direct electrical connection through a GPIO-level threshold-limited path to pure physical proximity without intentional logical wiring. The direct-connection baseline matches 255 of 256 streamed AES-256 key-bit decisions (99.61%) using on-chip digital capture alone. The GPIO-level path shows an abrupt threshold-limited failure: with a 400 Ω pull-down, agreement remains at 100% for 0–300 Ω series resistance and collapses to an all-zeros classifier at 400 Ω and above, where the returned voltage no longer crosses the FPGA input-buffer threshold. The proximity-only matrix—24 conditions covering three placement distances and eight RO lengths—shows that calibrated key-bit separability is strongly distance- and RO-length-dependent: near placement reaches 99.61% supervised separability at N=35 and 100% for N=45–75, while medium and far placement remain partially distinguishable or weak.

The central finding is that on-chip reliability instruments can act as effective side-channel receivers not only through explicit electrical paths but also, under favourable physical conditions, through unintended proximity coupling. The practical risk is therefore not limited to designs containing deliberate Trojan wiring; it extends to any scenario in which an attacker can place or activate monitoring instrumentation near sensitive routing. The results motivate treating the placement and configuration of on-chip reliability instruments as security-relevant design decisions, enforcing physical separation between cryptographic key nets and untrusted instrumentation structures, and including routing-level proximity analysis in security verification flows.

Popular Abstract

Modern computer chips contain thousands of tiny monitoring circuits that help engineers track temperature, voltage, and manufacturing quality. These circuits—including a common structure called the Ring Oscillator (RO)—are essential for keeping chips reliable. However, the same physical sensitivity that makes them good sensors also creates a security risk: if an attacker can place or activate such a circuit near sensitive information, it may inadvertently leak secret data.

This study investigates that risk by asking how much secret information an on-chip monitor can recover under different coupling conditions. To answer this question in a controlled setting, the researchers used an FPGA—a reconfigurable chip that allows precise experimental control—as a proof-of-concept platform. A fixed AES encryption key served as the secret data source, and an RO acted as the on-chip listener.

In the first and strongest scenario, the selected key bit was wired directly to the RO. The monitor almost perfectly distinguished whether the bit was 0 or 1, matching 255 of 256 key bits correctly. In the second scenario, the direct wire was replaced by an external path through resistors. The monitor continued to work perfectly as long as the electrical signal remained strong enough, but it failed abruptly once the voltage dropped below the chip’s input recognition threshold. This shows that weakening a sensitive signal path does not necessarily remove the leakage risk.

The third and most challenging scenario removed any intentional wire connection entirely. The researchers asked whether physical proximity alone—through electrical cross-talk between nearby wires—could still allow the RO to distinguish key-bit values. The answer was nuanced: a short nearby RO could not reliably separate the bit values, but a longer nearby RO could. When the RO was sufficiently long and placed very close to the secret signal, it achieved perfect separability. At greater distances, the effect weakened and became unreliable.

The broader implication is that the security risk from on-chip monitoring circuits is not limited to designs containing deliberate malicious wiring. Even unintended physical proximity between a secret signal and a monitoring structure can create measurable information leakage under favourable conditions. This suggests that chip designers should treat the placement of monitoring circuits as a security decision, not merely a reliability one, and should keep such structures physically separated from cryptographic key material.

• author: Yang, Chenxin
• supervisor: Erik Larsson
• organization: Department of Electrical and Information Technology
• course: EITM02 20261
• year: 2026
• type: H2 - Master's Degree (Two Years)
• subject: Technology and Engineering
• report number: LU/LTH-EIT 2026-1163
• language: English
• id: 9238742
• date added to LUP: 2026-06-17 13:51:49
• date last changed: 2026-06-17 13:51:49