SRASA: a Generalized Theoretical Framework for Security and Reliability Analysis in Computing Systems

Bu, Lake; Dofe, Jaya; Yu, Qiaoyan; Kinsy, Michel A.

doi:10.1007/s41635-018-0047-0

Cited by 5 publications

(9 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Number of 64-bit words with X errors There are many other works that propose long-term solutions [28,30,40,68,81,82,88,111,128,134,152,213,222,226,243,245], building on our original work. [226] uses a probabilistic mechanism similar to PARA in the original RowHammer paper in addition to a small stack for maintaining access history information to determine whether adjacent rows need to be refreshed to avoid bit flips.…”

Section: Modulementioning

confidence: 99%

RowHammer: A Retrospective

Mutlu

Kim

2020

IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst.

162

129

View full text Add to dashboard Cite

This retrospective paper describes the RowHammer problem in Dynamic Random Access Memory (DRAM), which was initially introduced by Kim et al. at the ISCA 2014 conference [133]. RowHammer is a prime (and perhaps the first) example of how a circuit-level failure mechanism can cause a practical and widespread system security vulnerability. It is the phenomenon that repeatedly accessing a row in a modern DRAM chip causes bit flips in physically-adjacent rows at consistently predictable bit locations. RowHammer is caused by a hardware failure mechanism called DRAM disturbance errors, which is a manifestation of circuit-level cell-to-cell interference in a scaled memory technology.Researchers from Google Project Zero demonstrated in 2015 that this hardware failure mechanism can be effectively exploited by user-level programs to gain kernel privileges on real systems. Many other follow-up works demonstrated other practical attacks exploiting RowHammer. In this article, we comprehensively survey the scientific literature on RowHammer-based attacks as well as mitigation techniques to prevent RowHammer. We also discuss what other related vulnerabilities may be lurking in DRAM and other types of memories, e.g., NAND flash memory or Phase Change Memory, that can potentially threaten the foundations of secure systems, as the memory technologies scale to higher densities. We conclude by describing and advocating a principled approach to memory reliability and security research that can enable us to better anticipate and prevent such vulnerabilities.

show abstract

Section: Modulementioning

confidence: 99%

RowHammer: A Retrospective

Mutlu

Kim

2020

IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst.

162

129

View full text Add to dashboard Cite

show abstract

“…Proposals for mitigating and/or preventing Rowhammer errors abound in both academia [5], [67], [102], [14], [56], [104], [29], [111], [80], [15], [7], [6], [9], [8], [34], [74], [58], [30], [63], [73], [99], [112] and industry [4], [39], [82], [24]; see [89] for a detailed survey of these works. However, while DRAM manufacturers claim that modern DRAM devices are resilient to Rowhammer bit-flips [81], [33], it is unclear what causes this resilience and under what conditions the Rowhammer-prevention mechanism may fail.…”

Section: The Rowhammer Threatmentioning

confidence: 99%

“…Many prior works build upon the Rowhammer phenomenon [88], [69], [89] for both attacks [32], [101], [97], [110], [37], [25], [36], [106], [83], [114], [13], [96], [11], [59], [95], [2], [105], [94], [16], [18], [10], [118], [12], [22], [62], [76] and defenses [4], [39], [82], [24], [5], [67], [102], [14], [56], [104], [29], [111], [80], [15], [7], [6], [9], [8], [34], [74], [58],…”

Section: Related Workmentioning

confidence: 99%

Are We Susceptible to Rowhammer? An End-to-End Methodology for Cloud Providers

Cojocar

Kim

Patel

et al. 2020

2020 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Cloud providers are concerned that Rowhammer poses a potentially critical threat to their servers, yet today they lack a systematic way to test whether the DRAM used in their servers is vulnerable to Rowhammer attacks. This paper presents an endto-end methodology to determine if cloud servers are susceptible to these attacks. With our methodology, a cloud provider can construct worst-case testing conditions for DRAM.We apply our methodology to three classes of servers from a major cloud provider. Our findings show that none of the CPU instruction sequences used in prior work to mount Rowhammer attacks create worst-case DRAM testing conditions. To address this limitation, we develop an instruction sequence that leverages microarchitectural side-effects to "hammer" DRAM at a near-optimal rate on modern Intel Skylake and Cascade Lake platforms. We also design a DDR4 fault injector that can reverse engineer row adjacency for any DDR4 DIMM. When applied to our cloud provider's DIMMs, we find that DRAM rows do not always follow a linear map.

show abstract

“…and software (e.g., [13,16,41,170,178,198,341,197,124,135,43,86,358,36,169,351,49,350]) levels. DRAM manufacturers themselves employ in-DRAM RowHammer prevention mechanisms such as Target Row Refresh (TRR) [139], which internally performs proprietary operations to reduce the vulnerability of a DRAM chip against potential RowHammer attacks, although these solutions have been recently shown to be vulnerable [87].…”

Section: Rowhammer: Dram Disturbance Errorsmentioning

confidence: 99%

“…While their analysis identifies a likely explanation for the failure mechanism responsible for RowHammer, they do not present experimental data taken from real devices to support their conclusions. [372,303,16,178,341,41,170,159,135,99,194,43,23,25,28,103,26,24,13,124,197,86,118,358,36,169,351,83,49,198,350] propose RowHammer mitigation techniques. Additionally, several patents for RowHammer prevention mechanisms have been filed [24,25,28,26,23,102].…”

Section: Real Chip Studiesmentioning

confidence: 99%

Improving DRAM Performance, Security, and Reliability by Understanding and Exploiting DRAM Timing Parameter Margins

Kim

2021

Preprint

View full text Add to dashboard Cite

Characterization of real DRAM devices has enabled findings in DRAM device properties, which has led to proposals that significantly improve overall system performance by reducing DRAM access latency and power consumption. In addition to improving system performance, a deeper understanding of DRAM technology via characterization can also improve device reliability and security. These can be seen with the recent discoveries of 1) DRAM-based true random number generators (TRNGs), a method for generating true random numbers using DRAM devices which can be used in many applications, 2) DRAM-based physical unclonable functions (PUFs), a method for generating unique device-dependent keys for identification and authentication, and 3) the RowHammer vulnerability, a phenomenon where repeatedly accessing a DRAM row can cause failures in unaccessed neighboring DRAM rows.To advance DRAM-based discoveries and mechanisms, this dissertation rigorously characterizes many modern commodity DRAM devices and shows that by exploiting DRAM access timing margins within manufacturer-recommended DRAM timing specifications, we can significantly improve system performance, reduce power consumption, and improve device reliability and security. First, we characterize DRAM timing parameter margins and find that certain regions of DRAM can be accessed faster than other regions due to DRAM cell process manufacturing variation. We exploit this by enabling variable access times depending on the DRAM cells being accessed, which not only improves overall system performance, but also decreases power consumption. Second, we find that we can uniquely identify DRAM devices by the locations of failures that result when we access DRAM with timing parameters reduced below specification values. Because we induce these failures with DRAM accesses, we can generate these unique identifiers significantly more quickly than prior work. Third, we propose a random number generator that is based on our observation that timing failures in certain DRAM cells are randomly induced and can thus be repeatedly polled to very quickly generate true random values. Finally, we characterize the RowHammer security vulnerability on a wide range of modern DRAM chips while violating the DRAM refresh requirement in order to directly characterize the underlying DRAM technology without the interference of refresh commands. We demonstrate with our characterization of real chips, that existing RowHammer mitigation mechanisms either are not scalable or suffer from prohibitively large performance overheads in projected future devices and it is critical to research more effective solutions to RowHammer. Overall, our studies build a new understanding of modern DRAM devices to improve computing system performance, reliability and security all at the same time. I have many people to thank for their support during my PhD journey. First and foremost, I am extremely grateful to my advisor, Onur Mutlu, who has generously mentored and guided me since my sophomore year of college. His passion for C...

show abstract

SRASA: a Generalized Theoretical Framework for Security and Reliability Analysis in Computing Systems

Cited by 5 publications

References 34 publications

RowHammer: A Retrospective

RowHammer: A Retrospective

Are We Susceptible to Rowhammer? An End-to-End Methodology for Cloud Providers

Improving DRAM Performance, Security, and Reliability by Understanding and Exploiting DRAM Timing Parameter Margins

Contact Info

Product

Resources

About