Remote dynamic partial reconfiguration: A threat to Internet-of-Things and embedded security applications

Anju Johnson, Sikhar Patranabis, Rajat Subhra Chakraborty, Debdeep Mukhopadhyay

Research output: Contribution to journalArticlepeer-review

16 Citations (Scopus)


The advent of the Internet of Things has motivated the use of Field Programmable Gate Array (FPGA) devices with Dynamic Partial Reconfiguration (DPR) capabilities for dynamic non-invasive modifications to circuits implemented on the FPGA. In particular, the ability to perform DPR over the network is essential in the context of a growing number of Internet of Things (IoT)-based and embedded security applications. However, the use of remote DPR brings with it a number of security threats that could lead to potentially catastrophic consequences in practical scenarios. In this paper, we demonstrate four examples where the remote DPR capability of the FPGA may be exploited by an adversary to launch Hardware Trojan Horse (HTH) attacks on commonly used security applications. We substantiate the threat by demonstrating remotely-launched attacks on Xilinx FPGA-based hardware implementations of a cryptographic algorithm, a true random number generator, and two processor based security applications - namely, a software implementation of a cryptographic algorithm and a cash dispensing scheme. The attacks are launched by on-the-fly transfer of malicious FPGA configuration bitstreams over an Ethernet connection to perform DPR and leak sensitive information. Finally, we comment on plausible countermeasures to prevent such attacks
Original languageEnglish
Pages (from-to)131-144
Number of pages14
JournalMicroprocessors and Microsystems
Early online date8 Jun 2017
Publication statusPublished - Jul 2017
Externally publishedYes


Dive into the research topics of 'Remote dynamic partial reconfiguration: A threat to Internet-of-Things and embedded security applications'. Together they form a unique fingerprint.

Cite this