In recent decades, due to the emerging requirements of computation acceleration, cloud FPGAs have become popular in public clouds. Major cloud service providers, e.g. AWS and Microsoft Azure have provided FPGA computing resources in their infrastructure and have enabled users to design and deploy their own accelerators on these FPGAs. Multi-tenancy FPGAs, where multiple users can share the same FPGA fabric with certain types of isolation to improve resource efficiency, have already been proved feasible. However, this also raises security concerns. Various types of side-channel attacks targeting multi-tenancy FPGAs have been proposed and validated. The awareness of security vulnerabilities in the cloud has motivated cloud providers to take action to enhance the security of their cloud environments. In FPGA security research papers, researchers always perform attacks under the assumption that attackers successfully co-locate with victims and are aware of the existence of victims on the same FPGA board. However, the way to reach this point, i.e., how attackers secretly obtain information regarding accelerators on the same fabric, is constantly ignored despite the fact that it is non-trivial and important for attackers. In this paper, we present a novel fingerprinting attack to gain the types of co-located FPGA accelerators. We utilize a seemingly non-malicious benchmark accelerator to sniff the communication link and collect performance traces of the FPGA-host communication link. By analyzing these traces, we are able to achieve high classification accuracy for fingerprinting co-located accelerators, which proves that attackers can use our method to perform cloud FPGA accelerator fingerprinting with a high success rate. As far as we know, this is the first paper targeting multi-tenant FPGA accelerator fingerprinting with the communication side-channel.

翻译：近几十年来，由于计算加速的新兴需求，云FPGA在公有云中逐渐普及。主流云服务提供商（如AWS和Azure）已在其基础设施中提供FPGA计算资源，允许用户在FPGA上设计并部署自有加速器。多租户FPGA（即通过特定隔离方式允许多用户共享同一FPGA芯片以提升资源利用率）已被证明可行。然而，这也引发了安全问题。针对多租户FPGA的多种侧信道攻击已被提出并验证。云服务提供商对安全漏洞的认知促使他们采取措施加强云环境的安全性。在FPGA安全研究论文中，研究人员通常假设攻击者已成功与受害者实现同驻，且已知受害者存在于同一FPGA板上。然而，如何实现这一前提——即攻击者如何秘密获取同芯片上加速器的信息——尽管对攻击者而言至关重要且并非易事，却始终被忽略。本文提出一种新型指纹识别攻击，用于获取同驻FPGA加速器的类型。我们利用一个看似无害的基准测试加速器嗅探通信链路，收集FPGA-主机通信链路的性能轨迹。通过分析这些轨迹，我们能够以高分类精度识别同驻加速器，证明攻击者可使用我们的方法以高成功率实现云FPGA加速器指纹识别。据我们所知，这是首篇针对多租户FPGA加速器通信侧信道指纹识别的研究论文。