The confusion method of FPGA configuration bitstream for defending against StarBleed vulnerability

Aiming at the StarBleed vulnerability in Xilinx's 7 series/Virx-6 FPGA, an new enhanced method based on configuration bitstream confusion was proposed by analyzing the attack process and its key steps. Firstly, it decrypts the ciphertext bitstream generated by Vivado to get the plaintext bitstream. Methods of instruction sequence confusion, instruction words confusion and instruction parameters confusion were proposed for configuration instructions in plaintext bit stream. For the HMAC signature area in the plaintext bitstream, the i_key_pad and o_key_pad data areas are confused as well. Then HMAC signature recalculation is performed after the confusion. Then re-perform the AES encryption to obtain the final confused ciphertext bitstream. That's the multi-method which realize the prevention on the critical step of ciphertext modification in vulnerability attack. Evaluation on the obfuscation with machine learning algorithm shows that confusion method can improve the similarity between the plaintext data and the ciphertext data. It can effectively increase the attack difficulty without hardware change and can improve the protection ability on the StarBleed vulnerability at a low cost.