Voltage noise analysis with ring oscillator clocks

Voltage noise is the main source of dynamic variability in integrated circuits and a major concern for the design of Power Delivery Networks (PDNs). Ring Oscillators Clocks (ROCs) have been proposed as an alternative to mitigate the negative effects of voltage noise as technology scales down and power density increases. However, their effectiveness highly depends on the design parameters of the PDN, power consumption patterns of the system and spatial locality of the ROCs within the clock domains. This paper analyzes the impact of the PDN parameters and ROC location on the robustness to voltage noise. The capability of reacting instantaneously to unpredictable voltage droops makes ROCs an attractive solution, which allows to reduce the amount of decoupling capacitance without downgrading performance. Tolerance to voltage noise and related benefits can be increased by using multiple ROCs and reducing the size of the clock domains. The analysis shows that up to 83% of the margins for voltage noise and up to 27% of the leakage power can be reduced by using local ROCs.Peer ReviewedPostprint (author's final draft

Doctor of Philosophy

dissertationSince the late 1950s, scientists have been working toward realizing implantable devices that would directly monitor or even control the human body's internal activities. Sophisticated microsystems are used to improve our understanding of internal biological processes in animals and humans. The diversity of biomedical research dictates that microsystems must be developed and customized specifically for each new application. For advanced long-term experiments, a custom designed system-on-chip (SoC) is usually necessary to meet desired specifications. Custom SoCs, however, are often prohibitively expensive, preventing many new ideas from being explored. In this work, we have identified a set of sensors that are frequently used in biomedical research and developed a single-chip integrated microsystem that offers the most commonly used sensor interfaces, high computational power, and which requires minimum external components to operate. Included peripherals can also drive chemical reactions by setting the appropriate voltages or currents across electrodes. The SoC is highly modular and well suited for prototyping in and ex vivo experimental devices. The system runs from a primary or secondary battery that can be recharged via two inductively coupled coils. The SoC includes a 16-bit microprocessor with 32 kB of on chip SRAM. The digital core consumes 350 μW at 10 MHz and is capable of running at frequencies up to 200 MHz. The integrated microsystem has been fabricated in a 65 nm CMOS technology and the silicon has been fully tested. Integrated peripherals include two sigma-delta analog-to-digital converters, two 10-bit digital-to-analog converters, and a sleep mode timer. The system also includes a wireless ultra-wideband (UWB) transmitter. The fullydigital transmitter implementation occupies 68 x 68 μm2 of silicon area, consumes 0.72 μW static power, and achieves an energy efficiency of 19 pJ/pulse at 200 MHz pulse repetition frequency. An investigation of the suitability of the UWB technology for neural recording systems is also presented. Experimental data capturing the UWB signal transmission through an animal head are presented and a statistical model for large-scale signal fading is developed

Wireless power transfer for combined sensing and stimulation in implantable biomedical devices

Actuellement, il existe une forte demande de Headstage et de microsystèmes intégrés implantables pour étudier l’activité cérébrale de souris de laboratoire en mouvement libre. De tels dispositifs peuvent s’interfacer avec le système nerveux central dans les paradigmes électriques et optiques pour stimuler et surveiller les circuits neuronaux, ce qui est essentiel pour découvrir de nouveaux médicaments et thérapies contre des troubles neurologiques comme l’épilepsie, la dépression et la maladie de Parkinson. Puisque les systèmes implantables ne peuvent pas utiliser une batterie ayant une grande capacité en tant que source d’énergie primaire dans des expériences à long terme, la consommation d’énergie du dispositif implantable est l’un des principaux défis de ces conceptions. La première partie de cette recherche comprend notre proposition de la solution pour diminuer la consommation d’énergie des microcircuits implantables. Nous proposons un nouveau circuit de décalage de niveau qui convertit les niveaux de signaux sub-seuils en niveaux ultra-bas à haute vitesse en utilisant une très faible puissance et une petite zone de silicium, ce qui le rend idéal pour les applications de faible puissance. Le circuit proposé introduit une nouvelle topologie de décaleur de niveau de tension utilisant un condensateur de décalage de niveau pour augmenter la plage de tensions de conversion, tout en réduisant considérablement le retard de conversion. Le circuit proposé atteint un délai de propagation plus court et une zone de silicium plus petite pour une fréquence de fonctionnement et une consommation d’énergie donnée par rapport à d’autres solutions de circuit. Les résultats de mesure sont présentés pour le circuit proposé fabriqué dans un processus CMOS TSMC de 0,18- mm. Le circuit présenté peut convertir une large gamme de tensions d’entrée de 330 mV à 1,8 V et fonctionner sur une plage de fréquence de 100 Hz à 100 MHz. Il a un délai de propagation de 29 ns et une consommation d’énergie de 61,5 nW pour les signaux d’entrée de 0,4 V, à une fréquence de 500 kHz, surpassant les conceptions précédentes. La deuxième partie de cette recherche comprend nos systèmes de transfert d’énergie sans fil proposé pour les applications optogénétiques. L’optogénétique est la combinaison de la méthode génétique et optique d’excitation, d’enregistrement et de contrôle des neurones biologiques. Ce système combine plusieurs technologies telles que les MEMS et la microélectronique pour collecter et transmettre les signaux neuronaux et activer un stimulateur optique via une liaison sans fil. Puisque les stimulateurs optiques consomment plus de puissance que les stimulateurs électriques, l’interface utilise la transmission de puissance par induction en utilisant des moyens innovants au lieu de la batterie avec la petite capacité comme source d’énergie.Notre première contribution dans la deuxième partie fournit un système de cage domestique intelligent basé sur des barrettes multi-bobines superposées à travers un récepteur multicellulaire implantable mince de taille 1×1 cm2, implanté sous le cuir chevelu d’une souris de laboratoire, et unité de gestion de l’alimentation intégrée. Ce système inductif est conçu pour fournir jusqu’à 35,5 mW de puissance délivrée à un émetteur-récepteur full duplex de faible puissance entièrement intégré pour prendre en charge des implants neuronaux à haute densité et bidirectionnels. L’émetteur (TX) utilise une bande ultra-large à impulsions radio basée sur des approches de combinaison, et le récepteur (RX) utilise une topologie à bande étroite à incrémentation de 2,4 GHz. L’émetteur-récepteur proposé fournit un débit de données de liaison montante TX à 500 Mbits/s double et un débit de données de liaison descendante RX à 100 Mbits/s, et est entièrement intégré dans un processus CMOS TSMC de 0,18-mm d’une taille totale de 0,8 mm2 . La puissance peut être délivrée à partir d’un signal de porteuse de 13,56-MHz avec une efficacité globale de transfert de puissance supérieure à 5% sur une distance de séparation allant de 3 cm à 5 cm. Notre deuxième contribution dans les systèmes de collecte d’énergie porte sur la conception et la mise en oeuvre d’une cage domestique de transmission de puissance sans fil (WPT) pour une plate-forme de neurosciences entièrement sans fil afin de permettre des expériences optogénétiques ininterrompues avec des rongeurs de laboratoire vivants. La cage domestique WPT utilise un nouveau réseau hybride de transmetteurs de puissance (TX) et des résonateurs multi-bobines segmentés pour atteindre une efficacité de transmission de puissance élevée (PTE) et délivrer une puissance élevée sur des distances aussi élevées que 20 cm. Le récepteur de puissance à bobines multiples (RX) utilise une bobine RX d’un diamètre de 1 cm et une bobine de résonateur d’un diamètre de 1,5 cm. L’efficacité moyenne du transfert de puissance WPT est de 29, 4%, à une distance nominale de 7 cm, pour une fréquence porteuse de 13,56 MHz. Il a des PTE maximum et minimum de 50% et 12% le long de l’axe Z et peut délivrer une puissance constante de 74 mW pour alimenter le headstage neuronal miniature. En outre, un dispositif implantable intégré dans un processus CMOS TSMC de 0,18-mm a été conçu et introduit qui comprend 64 canaux d’enregistrement, 16 canaux de stimulation optique, capteur de température, émetteur-récepteur et unité de gestion de l’alimentation (PMU). Ce circuit est alimenté à l’intérieur de la cage du WPT à l’aide d’une bobine réceptrice d’un diamètre de 1,5 cm pour montrer les performances du circuit PMU. Deux tensions régulées de 1,8 V et 1 V fournissent 79 mW de puissance pour tout le système sur une puce. Notre dernière contribution est un système WPT insensible aux désalignements angulaires pour alimenter un headstage pour des applications optogénétiques qui a été précédemment proposé par le Laboratoire de Microsystèmes Biomédicaux (BioML-UL) à ULAVAL. Ce système est la version étendue de notre deuxième contribution aux systèmes de collecte d’énergie.Dans la version mise à jour, un récepteur de puissance multi-bobines utilise une bobine RX d’un diamètre de 1,0 cm et une nouvelle bobine de résonateur fendu d’un diamètre de 1,5 cm, qui résiste aux défauts d’alignement angulaires. Dans cette version qui utilise une cage d’animal plus petite que la dernière version, 4 résonateurs sont utilisés côté TX. De plus, grâce à la forme et à la position de la bobine de répéteur L3 du côté du récepteur, la liaison résonnante hybride présentée peut correctement alimenter la tête sans interruption causée par le désalignement angulaire dans toute la cage de la maison. Chaque 3 tours du répéteur RX a été enveloppé avec un diamètre de 1,5 cm, sous différents angles par rapport à la bobine réceptrice. Les résultats de mesure montrent un PTE maximum et minimum de 53 % et 15 %. La méthode proposée peut fournir une puissance constante de 82 mW pour alimenter le petit headstage neural pour les applications optogénétiques. De plus, dans cette version, la performance du système est démontrée dans une expérience in-vivo avec une souris ChR2 en mouvement libre qui est la première expérience optogénétique sans fil et sans batterie rapportée avec enregistrement électrophysiologique simultané et stimulation optogénétique. L’activité électrophysiologique a été enregistrée après une stimulation optogénétique dans le Cortex Cingulaire Antérieur (CAC) de la souris.Our first contribution in the second part provides a smart home-cage system based on overlapped multi-coil arrays through a thin implantable multi-coil receiver of 1×1 cm2 of size, implantable bellow the scalp of a laboratory mouse, and integrated power management circuits. This inductive system is designed to deliver up to 35.5 mW of power delivered to a fully-integrated, low-power full-duplex transceiver to support high-density and bidirectional neural implants. The transmitter (TX) uses impulse radio ultra-wideband based on an edge combining approach, and the receiver (RX) uses a 2.4- GHz on-off keying narrow band topology. The proposed transceiver provides dual-band 500-Mbps TX uplink data rate and 100-Mbps RX downlink data rate, and it is fully integrated into 0.18-mm TSMC CMOS process within a total size of 0.8 mm2. The power can be delivered from a 13.56-MHz carrier signal with an overall power transfer efficiency above 5% across a separation distance ranging from 3 cm to 5 cm. Our second contribution in power-harvesting systems deals with designing and implementation of a WPT home-cage for a fully wireless neuroscience platform for enabling uninterrupted optogenetic experiments with live laboratory rodents. The WPT home-cage uses a new hybrid parallel power transmitter (TX) coil array and segmented multi-coil resonators to achieve high power transmission efficiency (PTE) and deliver high power across distances as high as 20 cm. The multi-coil power receiver (RX) uses an RX coil with a diameter of 1 cm and a resonator coil with a diameter of 1.5 cm. The WPT home-cage average power transfer efficiency is 29.4%, at a nominal distance of 7 cm, for a power carrier frequency of 13.56-MHz. It has maximum and minimum PTE of 50% and 12% along the Z axis and can deliver a constant power of 74 mW to supply the miniature neural headstage. Also, an implantable device integrated into a 0.18-mm TSMC CMOS process has been designed and introduced which includes 64 recording channels, 16 optical stimulation channels, temperature sensor, transceiver, and power management unit (PMU). This circuit powered up inside the WPT home-cage using receiver coil with a diameter of 1.5 cm to show the performance of the PMU circuit. Two regulated voltages of 1.8 V and 1 V provide 79 mW of power for all the system on a chip. Our last contribution is an angular misalignment insensitive WPT system to power up a headstage which has been previously proposed by the Biomedical Microsystems Laboratory (BioML-UL) at ULAVAL for optogenetic applications. This system is the extended version of our second contribution in power-harvesting systems. In the updated version a multi-coil power receiver uses an RX coil with a diameter of 1.0 cm and a new split resonator coil with a diameter of 1.5 cm, which is robust against angular misalignment. In this version which is using a smaller animal home-cage than the last version, 4 resonators are used on the TX side. Also, thanks to the shape and position of the repeater coil of L3 on the receiver side, the presented hybrid resonant link can properly power up the headstage without interruption caused by the angular misalignment all over the home-cage. Each 3 turns of the RX repeater has been wrapped up with a diameter of 1.5 cm, in different angles compared to the receiver coil. Measurement results show a maximum and minimum PTE of 53 % and 15 %. The proposed method can deliver a constant power of 82 mW to supply the small neural headstage for the optogenetic applications. Additionally, in this version, the performance of the system is demonstrated within an in-vivo experiment with a freely moving ChR2 mouse which is the first fully wireless and batteryless optogenetic experiment reported with simultaneous electrophysiological recording and optogenetic stimulation. Electrophysiological activity was recorded after delivering optogenetic stimulation in the Anterior Cingulate Cortex (ACC) of the mouse.Currently, there is a high demand for Headstage and implantable integrated microsystems to study the brain activity of freely moving laboratory mice. Such devices can interface with the central nervous system in both electrical and optical paradigms for stimulating and monitoring neural circuits, which is critical to discover new drugs and therapies against neurological disorders like epilepsy, depression, and Parkinson’s disease. Since the implantable systems cannot use a battery with a large capacity as a primary source of energy in long-term experiments, the power consumption of the implantable device is one of the leading challenges of these designs. The first part of this research includes our proposed solution for decreasing the power consumption of the implantable microcircuits. We propose a novel level shifter circuit which converting subthreshold signal levels to super-threshold signal levels at high-speed using ultra low power and a small silicon area, making it well-suited for low-power applications such as wireless sensor networks and implantable medical devices. The proposed circuit introduces a new voltage level shifter topology employing a level-shifting capacitor to increase the range of conversion voltages, while significantly reducing the conversion delay. The proposed circuit achieves a shorter propagation delay and a smaller silicon area for a given operating frequency and power consumption compared to other circuit solutions. Measurement results are presented for the proposed circuit fabricated in a 0.18-mm TSMC CMOS process. The presented circuit can convert a wide range of the input voltages from 330 mV to 1.8 V, and operate over a frequency range of 100-Hz to 100-MHz. It has a propagation delay of 29 ns, and power consumption of 61.5 nW for input signals 0.4 V, at a frequency of 500-kHz, outperforming previous designs. The second part of this research includes our proposed wireless power transfer systems for optogenetic applications. Optogenetics is the combination of the genetic and optical method of excitation, recording, and control of the biological neurons. This system combines multiple technologies such as MEMS and microelectronics to collect and transmit the neuronal signals and to activate an optical stimulator through a wireless link. Since optical stimulators consume more power than electrical stimulators, the interface employs induction power transmission using innovative means instead of the battery with the small capacity as a power source

Low-Power Energy Efficient Circuit Techniques for Small IoT Systems

Although the improvement in circuit speed has been limited in recent years, there has been increased focus on the internet of things (IoT) as technology scaling has decreased circuit size, power usage and cost. This trend has led to the development of many small sensor systems with affordable costs and diverse functions, offering people convenient connection with and control over their surroundings. This dissertation discusses the major challenges and their solutions in realizing small IoT systems, focusing on non-digital blocks, such as power converters and analog sensing blocks, which have difficulty in following the traditional scaling trends of digital circuits. To accommodate the limited energy storage and harvesting capacity of small IoT systems, this dissertation presents an energy harvester and voltage regulators with low quiescent power and good efficiency in ultra-low power ranges. Switched-capacitor-based converters with wide-range energy-efficient voltage-controlled oscillators assisted by power-efficient self-oscillating voltage doublers and new cascaded converter topologies for more conversion ratio configurability achieve efficient power conversion down to several nanowatts. To further improve the power efficiency of these systems, analog circuits essential to most wireless IoT systems are also discussed and improved. A capacitance-to-digital sensor interface and a clocked comparator design are improved by their digital-like implementation and operation in phase and frequency domain. Thanks to the removal of large passive elements and complex analog blocks, both designs achieve excellent area reduction while maintaining state-of-art energy efficiencies. Finally, a technique for removing dynamic voltage and temperature variations is presented as smaller circuits in advanced technologies are more vulnerable to these variations. A 2-D simultaneous feedback control using an on-chip oven control locks the supply voltage and temperature of a small on-chip domain and protects circuits in this locked domain from external voltage and temperature changes, demonstrating 0.0066 V/V and 0.013 °C/°C sensitivities to external changes. Simple digital implementation of the sensors and most parts of the control loops allows robust operation within wide voltage and temperature ranges.PHDElectrical EngineeringUniversity of Michigan, Horace H. Rackham School of Graduate Studieshttps://deepblue.lib.umich.edu/bitstream/2027.42/138743/1/wanyeong_1.pd

Design methodology for reliable and energy efficient self-tuned on-chip voltage regulators

The energy-efficiency needs in computing systems, ranging from high performance processors to low-power devices is steadily on the rise, resulting in increasing popularity of on-chip voltage regulators (VR). The high-frequency and high bandwidth on-chip voltage regulators such as Inductive voltage regulators (IVR) and Digital Low Dropout regulators (DLDO) significantly enhance the energy-efficiency of a SoC by reducing supply noise and enabling faster voltage transitions. However, IVRs and DLDOs need to cope with the higher variability that exists in the deep nanometer digital nodes since they are fabricated on the same die as the digital core affecting performance of both the VR and digital core. Moreover, in most modern SoCs where multiple power domains are preferred, each VR needs to be designed and optimized for a target load demand which significantly increases the design time and time to market for VR assisted SoCs. This thesis investigates a performance-based auto-tuning algorithm utilizing performance of digital core to tune VRs against variations and improve performance of both VR and the core. We further propose a fully synthesizable VR architecture and an auto-generation tool flow that can be used to design and optimize a VR for given target specifications and auto-generate a GDS layout. This would reduce the design time drastically. And finally, a flexible precision IVR architecture is also explored to further improve transient performance and tolerance to process variations. The proposed IVR and DLDO designs with an AES core and auto-tuning circuits are prototyped in two testchips in 130nm CMOS process and one test chip in 65nm CMOS process. The measurements demonstrate improved performance of IVR and AES core due to performance-based auto-tuning. Moreover, the synthesizable architectures of IVR and DLDO implemented using auto-generation tool flow showed competitive performance with state of art full custom designs with orders of magnitude reduction in design time. Additional improvement in transient performance of IVR is also observed due to the flexible precision feedback loop design.Ph.D

Integrated circuit & system design for concurrent amperometric and potentiometric wireless electrochemical sensing

Complementary Metal-Oxide-Semiconductor (CMOS) biosensor platforms have steadily grown in healthcare and commerial applications. This technology has shown potential in the field of commercial wearable technology, where CMOS sensors aid the development of miniaturised sensors for an improved cost of production and response time. The possibility of utilising wireless power and data transmission techniques for CMOS also allows for the monolithic integration of the communication, power and sensing onto a single chip, which greatly simplifies the post-processing and improves the efficiency of data collection. The ability to concurrently utilise potentiometry and amperometry as an electrochemical technique is explored in this thesis. Potentiometry and amperometry are two of the most common transduction mechanisms for electrochemistry, with their own advantages and disadvantages. Concurrently applying both techniques will allow for real-time calibration of background pH and for improved accuracy of readings. To date, developing circuits for concurrently sensing potentiometry and amperometry has not been explored in the literature. This thesis investigates the possibility of utilising CMOS sensors for wireless potentiometric and amperometric electrochemical sensing. To start with, a review of potentiometry and amperometry is evaluated to understand the key factors behind their operation. A new configuration is proposed whereby the reference electrode for both electrochemistry techniques are shared. This configuration is then compared to both the original configurations to determine any differences in the sensing accuracy through a novel experiment that utilises hydrogen peroxide as a measurement analyte. The feasibility of the configuration with the shared reference electrode is proven and utilised as the basis of the electrochemical configuration for the front end circuits. A unique front-end circuit named DAPPER is developed for the shared reference electrode topology. A review of existing architectures for potentiometry and amperometry is evaluated, with a specific focus on low power consumption for wireless applications. In addition, both the electrochemical sensing outputs are mixed into a single output data channel for use with a near-field communication (NFC). This mixing technique is also further analysed in this thesis to understand the errors arising due to various factors. The system is fabricated on TSMC 180nm technology and consumes 28µW. It measures a linear input current range from 250pA - 0.1µW, and an input voltage range of 0.4V - 1V. This circuit is tested and verified for both electrical and electrochemical tests to showcase its feasibility for concurrent measurements. This thesis then provides the integration of wireless blocks into the system for wireless powering and data transmission. This is done through the design of a circuit named SPACEMAN that consists of the concurrent sensing front-end, wireless power blocks, data transmission, as well as a state machine that allows for the circuit to switch between modes: potentiometry only, amperometry only, concurrent sensing and none. The states are switched through re-booting the circuit. The core size of the electronics is 0.41mm² without the coil. The circuit’s wireless powering and data transmission is tested and verified through the use of an external transmitter and a connected printed circuit board (PCB) coil. Finally, the future direction for ongoing work to proceed towards a fully monolithic electrochemical technique is discussed through the next development of a fully integrated coil-on-CMOS system, on-chip electrodes with the electroplating and microfludics, the development of an external transmitter for powering the device and a test platform. The contributions of this thesis aim to formulate a use for wireless electrochemical sensors capable of concurrent measurements for use in wearable devices.Open Acces

Design And Implementation Of An X-Band Passive Rfid Tag

This research presents a novel fully integrated energy harvester, matching network, matching network,matching network, matching network,matching network, matching network, matching network, multi-stage RF-DC rectifier, mode selector, RC oscillator, LC oscillator, and X-band power amplifier implemented in IBM 0.18-µm RF CMOS technology. We investigated different matching schemes, antennas, and rectifiers with focus on the interaction between building blocks. Currently the power amplifier gives the maximum output power of 5.23 dBm at 9.1GHz. The entire RFID tag circuit was designed to operate in low power consumption. Voltage sensor circuit which generates the enable signal was designed to operate in very low current. All the test blocks of the RFID tag were tested. The smaller size and the cost of the RFID tag are critical for widespread adoption of the technology. The cost of the RFID tag can be lowered by implementing an on-chip antenna. We were able to develop, fabricate, and implement a fully integrated RFID tag in a smaller size (3 mm X 1.5 mm) than the existing tags. With further modifications, this could be used as a commercial low cost RFID tag

Active timing margin management to improve microprocessor power efficiency

Improving power/performance efficiency is critical for today’s micro- processors. From edge devices to datacenters, lower power or higher performance always produces better systems, measured by lower cost of ownership or longer battery time. This thesis studies improving microprocessor power/performance efficiency by optimizing the pipeline timing margin. In particular, this thesis focuses on improving the efficacy of Active Timing Margin, a young technology that dynamically adjusts the margin. Active timing margin trims down the pipeline timing margin with a control loop that adjusts voltage and frequency based on real-time chip environment monitoring. The key insight of this thesis is that in order to maximize active timing margin’s efficiency enhancement benefits, synergistic management from processor architecture design and system software scheduling are needed. To that end, this thesis covers the major consumers of pipeline timing margin, including temperature, voltage, and process variation. For temperature variation, the thesis proposes a table-lookup based active timing margin mechanism, and an associated temperature management scheme to minimize power consumption. For voltage variation, the thesis characterizes the limiting factors of adaptive clocking’s power saving and proposes application scheduling to maximize total system power reduction. For process variation, the thesis proposes core-level adaptive clocking reconfiguration to automatically expose inter-core variation and discusses workload scheduling and throttling management to control critical application performance. The author believes the optimization presented in this thesis can potentially benefit a variety of processor architectures as the conclusions are based on the solid measurement on state-of-the-art processors, and the research objective, active timing margin, already has wide applicability in the latest microprocessors by the time this thesis is written.Electrical and Computer Engineerin

A self-powered single-chip wireless sensor platform

Internet of things” require a large array of low-cost sensor nodes, wireless connectivity, low power operation and system intelligence. On the other hand, wireless biomedical implants demand additional specifications including small form factor, a choice of wireless operating frequencies within the window for minimum tissue loss and bio-compatibility This thesis describes a low power and low-cost internet of things system suitable for implant applications that is implemented in its entirety on a single standard CMOS chip with an area smaller than 0.5 mm2. The chip includes integrated sensors, ultra-low-power transceivers, and additional interface and digital control electronics while it does not require a battery or complex packaging schemes. It is powered through electromagnetic (EM) radiation using its on-chip miniature antenna that also assists with transmit and receive functions. The chip can operate at a short distance (a few centimeters) from an EM source that also serves as its wireless link. Design methodology, system simulation and optimization and early measurement results are presented

Remote Attacks on FPGA Hardware

Immer mehr Computersysteme sind weltweit miteinander verbunden und über das Internet zugänglich, was auch die Sicherheitsanforderungen an diese erhöht. Eine neuere Technologie, die zunehmend als Rechenbeschleuniger sowohl für eingebettete Systeme als auch in der Cloud verwendet wird, sind Field-Programmable Gate Arrays (FPGAs). Sie sind sehr flexible Mikrochips, die per Software konfiguriert und programmiert werden können, um beliebige digitale Schaltungen zu implementieren. Wie auch andere integrierte Schaltkreise basieren FPGAs auf modernen Halbleitertechnologien, die von Fertigungstoleranzen und verschiedenen Laufzeitschwankungen betroffen sind. Es ist bereits bekannt, dass diese Variationen die Zuverlässigkeit eines Systems beeinflussen, aber ihre Auswirkungen auf die Sicherheit wurden nicht umfassend untersucht. Diese Doktorarbeit befasst sich mit einem Querschnitt dieser Themen: Sicherheitsprobleme die dadurch entstehen wenn FPGAs von mehreren Benutzern benutzt werden, oder über das Internet zugänglich sind, in Kombination mit physikalischen Schwankungen in modernen Halbleitertechnologien. Der erste Beitrag in dieser Arbeit identifiziert transiente Spannungsschwankungen als eine der stärksten Auswirkungen auf die FPGA-Leistung und analysiert experimentell wie sich verschiedene Arbeitslasten des FPGAs darauf auswirken. In der restlichen Arbeit werden dann die Auswirkungen dieser Spannungsschwankungen auf die Sicherheit untersucht. Die Arbeit zeigt, dass verschiedene Angriffe möglich sind, von denen früher angenommen wurde, dass sie physischen Zugriff auf den Chip und die Verwendung spezieller und teurer Test- und Messgeräte erfordern. Dies zeigt, dass bekannte Isolationsmaßnahmen innerhalb FPGAs von böswilligen Benutzern umgangen werden können, um andere Benutzer im selben FPGA oder sogar das gesamte System anzugreifen. Unter Verwendung von Schaltkreisen zur Beeinflussung der Spannung innerhalb eines FPGAs zeigt diese Arbeit aktive Angriffe, die Fehler (Faults) in anderen Teilen des Systems verursachen können. Auf diese Weise sind Denial-of-Service Angriffe möglich, als auch Fault-Angriffe um geheime Schlüsselinformationen aus dem System zu extrahieren. Darüber hinaus werden passive Angriffe gezeigt, die indirekt die Spannungsschwankungen auf dem Chip messen. Diese Messungen reichen aus, um geheime Schlüsselinformationen durch Power Analysis Seitenkanalangriffe zu extrahieren. In einer weiteren Eskalationsstufe können sich diese Angriffe auch auf andere Chips auswirken die an dasselbe Netzteil angeschlossen sind wie der FPGA. Um zu beweisen, dass vergleichbare Angriffe nicht nur innerhalb FPGAs möglich sind, wird gezeigt, dass auch kleine IoT-Geräte anfällig für Angriffe sind welche die gemeinsame Spannungsversorgung innerhalb eines Chips ausnutzen. Insgesamt zeigt diese Arbeit, dass grundlegende physikalische Variationen in integrierten Schaltkreisen die Sicherheit eines gesamten Systems untergraben können, selbst wenn der Angreifer keinen direkten Zugriff auf das Gerät hat. Für FPGAs in ihrer aktuellen Form müssen diese Probleme zuerst gelöst werden, bevor man sie mit mehreren Benutzern oder mit Zugriff von Drittanbietern sicher verwenden kann. In Veröffentlichungen die nicht Teil dieser Arbeit sind wurden bereits einige erste Gegenmaßnahmen untersucht