By modifying the normal operating voltages and/or temperature of an FPGA, an attacker might attempt to cause the device to behave in an unintended way, such as to extract data from it or cause it to bypass certain security features. For example, the Federal Information Processing Standards Publication (FIPS) 140-2 Security Requirements For Cryptographic Modules states: “In particular, the cryptographic module shall monitor and correctly respond to fluctuations in the operating temperature and voltage outside of the specified normal operating ranges.”
To help meet this type of requirement, on-chip dedicated IP blocks can be used, namely, the UltraScale and UltraScale+ FPGA system monitor (SYSMONE1) (refer to UltraScale Architecture System Monitor User Guide (UG580). The SYSMONE1 is a multi-channel ADC within the FPGA and can be used to monitor on-chip power supply voltages, a number of I/O bank voltages, on-chip die temperature, and a number of user analog voltages fed into the FPGA’s external pins. The SYSMONE1 can be easily instantiated in your FPGA logic design. This type of on-chip monitoring is more secure than off-chip monitoring because it is harder to tamper with. You also have the option of using an external or internal voltage reference (VREF) for SYSMONE1. Although the external reference is more accurate, the internal reference is more secure because it is much more difficult for an adversary to tamper with. The selection between the internal and external reference is controlled by an external pin. You should thus read the appropriate SYSMONE2 status register to confirm that the internal VREF is being used. Refer to UltraScale Architecture System Monitor User Guide (UG580) for more information.
Upper and lower alarm limits can be programmed directly into SYSMONE1 for the on-chip parameters. Additional FPGA logic can be used to create alarm limits for external voltage inputs (for example, an external analog voltage tamper loop or the output of a pressure sensor). The status of the alarm signals can be used by your design or system to determine the appropriate course of action in case they become active (that is, determine the appropriate tamper penalty). The analog inputs are bandwidth limited (see UltraScale Architecture System Monitor User Guide (UG580) for the maximum input frequencies).
If detection of very fast changes in temperature or voltages is required, an off-chip solution might be required. It is up to you to define what the required detection bandwidth needs to be. The Sorcerer’s Apprentice Guide to Fault Attacks describes a number of methods to mount an attack on a chip, one of them being variations in the power supply voltage.