Shijin Duan

As FPGAs are being deployed in the cloud infrastructure for acceleration, the technology of multi-tenant FPGA has emerged as a topic of interest. This development has drawn considerable attention to its security issues. While previous research primarily focused on the security of applications, there has been limited exploration of the vulnerabilities inherent in FPGA IPs. In our work, we examine the vulnerabilities of two widely used data transmission protocols in modern FPGAs: the Advanced eXtensible Interface (AXI) and Peripheral Component Interconnect Express (PCIe). Our experiments, conducted with commercial FPGA development kits, launched fault injection attacks through the shared power distribution network (PDN). Through non-invasive electromagnetic (EM) trace measurement, we characterize the voltage fluctuation across various attack patterns. Subsequently, we simulate real-world data transfers using two crafted datasets with different statistical characteristics. The experimental results demonstrate the unique security vulnerabilities of the current AXI and PCIe protocols in the context of a multi-tenant cloud-FPGA. In response to such vulnerability, we further propose two defense strategies: InChAXI that utilizes integrity checking for AXI-based data, and FCPCIe that employs frequency scaling for PCIe-based data. The performance evaluation demonstrates that our proposed defenses can significantly reduce the fault injections on the AXI-based data transmission by 705 times with small overheads – 0.5% in hardware footprint and 7.9% in latency, respectively. On the other hand, FCPCIe effectively prevents the fault injection attack during the PCIe-based data transmission by reducing the user clock frequency, while incurring a 10.13% overhead on data throughput.

Artificial intelligence (AI) on tiny edge devices has become feasible thanks to the emergence of high-performance microcontrollers (MCUs) and lightweight machine learning (ML) models. Nevertheless, the cost and power consumption of these MCUs and the computation requirements of these ML algorithms still present barriers that prevent the widespread inclusion of AI functionality on smaller, cheaper, and lower-power devices. Thus, there is an urgent need for a more efficient ML algorithm and implementation strategy suitable for lower-end MCUs. This paper presents MicroVSA, a library of optimized implementations of a low-dimensional computing (LDC) classifier, a recently proposed variant of vector symbolic architecture (VSA), for 8, 16, and 32-bit MCUs. MicroVSA achieves up to 21.86x speedup and 8x less flash utilization compared to the vanilla LDC. Evaluation results on the three most common always-on inference tasks - myocardial infarction detection, human activity recognition, and hot word detection - demonstrate that MicroVSA outperforms traditional classifiers and achieves comparable accuracy to tiny deep learning models, while requiring only a few ten bytes of RAM and can easily fit in tiny 8-bit MCUs. For instance, our model for recognizing human activity from inertial sensor data only needs 2.46 KiB of flash and 0.02 KiB of RAM and can complete one inference in 0.85 ms on a 32-bit ARM Cortex-M4 MCU or 11.82 ms on a tiny 8-bit AVR MCU, whereas the RNN model running on a higher-end ARM Cortex-M3 requires 62.0 ms. Our study suggests that ubiquitous ML deployment on low-cost tiny MCUs is possible, and more study on VSA model training, model compression, and implementation techniques is needed to further lower the cost and power of ML on edge devices.

The growing prevalence of Machine Learning as a Service (MLaaS) enables a wide range of applications but simultaneously raises numerous security and privacy concerns. A key issue involves the potential privacy exposure of involved parties, such as the customer’s input data and the vendor’s model. Consequently, two-party computing (2PC) has emerged as a promising solution to safeguard the privacy of different parties during deep neural network (DNN) inference. However, the state-of-the-art (SOTA) 2PC-DNN techniques are tailored explicitly to traditional instruction set architecture (ISA) systems like CPUs and CPU+GPU. This reliance on ISA systems significantly constrains their energy efficiency, as these architectures typically employ 32- or 64-bit instruction sets. In contrast, the possibilities of harnessing dynamic and adaptive quantization to build high-performance 2PC-DNNs remain largely unexplored due to the lack of compatible algorithms and hardware accelerators. To mitigate the bottleneck of SOTA solutions and fill the existing research gaps, this work investigates the construction of 2PC-DNNs on field programmable gate arrays (FPGAs). We introduce AQ2PNN, an end-to-end framework that effectively employs adaptive quantization schemes to develop high-performance 2PC-DNNs on FPGAs. From an algorithmic perspective, AQ2PNN introduces an innovative 2PC-ReLU method to replace Yao’s Garbled Circuits (GC). Regarding hardware, AQ2PNN employs an extensive set of building blocks for linear operators, non-linear operators, and a specialized Oblivious Transfer (OT) module for secure data exchange, respectively. These algorithm-hardware co-designed modules extremely utilize the fine-grained reconfigurability of FPGAs, to adapt the data bit-width of different DNN layers in the ciphertext domain, thereby reducing communication overhead between parties without compromising DNN performance, such as accuracy. We thoroughly assess AQ2PNN using widely adopted DNN architectures, including ResNet18, ResNet50, and VGG16, all trained on ImageNet and producing quantized models. Experimental results demonstrate that AQ2PNN outperforms SOTA solutions, achieving significantly reduced communication overhead by, improved energy efficiency by 26.3 ×, and comparable or even superior throughput and accuracy.

FPGAs have been widely deployed in cloud servers a promising computing infrastructure. It is envisioned that through the FPGA virtualization, multiple users will be able to share the hardware resources of an FPGA chip. Although bringing great benefits like highly efficient resource utilization, such multi-tenant cloud-FPGA also raises security concerns. While most existing works have demonstrated that an application running on a multi-tenant FPGA is vulnerable to fault injection attacks introduced by the power distribution network (PDN) disturbance on an FPGA, few of them consider the impact of such power attacks on the data interface of an FPGA. As a critical component in charge of the data transmission between intra-FPGA IPs and/or inter-FPGA components, the runtime integrity of the communication interface plays an essential role in the security of a multi-tenant FPGA. This work, we investigate the impact of the PDN-based fault injection attacks on the Advanced eXtensible Interface (AXI) protocol as a case study. We find that like other circuit applications, the embedded AXI protocol interface also suffers from the PDN-based fault injection attacks, but with unique fault characteristics. To mitigate such vulnerabilities of the AXI in multi-tenant cloud-FPGA, we propose a runtime integrity checking framework. We evaluate the proposed framework with practical data transmission setup to demonstrate the effectiveness of the proposed scheme.