发表机构
Worcester Polytechnic Institute; Ruhr University Bochum（伍斯特理工学院; 波鸿鲁尔大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
Chypothermia利用低温干扰芯片混合信号组件，无需电气篡改即可禁用时钟与电压传感器，结合Chypnosis逃避温度检测，成功在FPGA/SoC及OpenTitan上实现攻击，并提出自加热传感器对策。
AI 中文摘要
静态侧信道攻击利用时钟停止条件来提取敏感信息，对芯片安全构成日益严重的威胁。为了应对这些攻击，已有多种防御方案被提出，这些方案监控异常的时钟行为，并在检测到时钟异常时触发敏感数据的清除。在本工作中，我们证明将芯片暴露于低温环境会干扰芯片上负责信号感知和生成的混合信号组件。基于这一观察，我们开发了Chypothermia攻击，该攻击无需对系统进行任何电气篡改，即可禁用目标时钟传感器、时钟生成电路和电压传感器，同时保留秘密数据。虽然冷却能有效停止时钟，但这是一个缓慢的过程，并且仅靠冷却往往不足以对抗配备有温度传感器以检测热异常的系统。为了绕过这些保护，我们将Chypothermia与Chypnosis（Mitard等人，IEEE SP 2026）相结合，并证明即使在中等低温工作范围内，这种组合也能在逃避检测的同时停止时钟。我们在多个FPGA/SoC平台上实现了Chypothermia，并成功演示了对软IP和硬IP传感器实现的禁用。最后，我们将Chypothermia应用于OpenTitan信任根的警报处理器（该处理器集成了最先进的时钟传感器），并证明该攻击能逃避检测并阻止密钥归零。最后，我们引入并实现了一种FPGA兼容的自加热传感器作为对策，并展示了其对Chypothermia的鲁棒性。
英文摘要
Static side-channel attacks, which exploit halted-clock conditions to extract sensitive information, pose an increasing threat to chip security. To counter these attacks, various defenses have been proposed that monitor for abnormal clock behavior and trigger the clearing of sensitive data when clock anomalies are detected. In this work, we demonstrate that exposing a chip to cryogenic temperatures interferes with on-chip mixed-signal components, responsible for signal sensing and generation. Based on this observation, we develop Chypothermia, an attack that, without any electrical tampering with the system, disables the target clock sensor, the clock generation circuit, and the voltage sensors, while preserving the secret data. While effective at halting the clock, cooling is a slow process and, on its own, is often insufficient against systems equipped with temperature sensors designed to detect thermal anomalies. To bypass these protections, we combine Chypothermia with Chypnosis (Mitard et al., IEEE SP 2026) and show that, even within a moderately low-temperature operating range, this combination can halt the clock while evading detection. We implement Chypothermia on multiple FPGA/SoC platforms and demonstrate successful disabling of both soft-IP and hard-IP sensor implementations. Finally, we apply Chypothermia to the alert handler of the OpenTitan root of trust, which incorporates a state-of-the-art clock sensor, and show that the attack evades detection and prevents key zeroization. Finally, we introduce and implement an FPGA-compatible self-heating sensor as a countermeasure and demonstrate its robustness against Chypothermia.
