Securing DRAM at Scale: ARFM-Driven Row Hammer Defense with Unveiling the Threat of Short tRC Patterns

TL;DR

This work addresses RH threats in DRAM at scale by proposing MARC, an ARFM-driven defense that augments existing RH mitigation IPs without requiring hardware redesign. MARC detects malicious RH attack patterns by monitoring short $t_{RC}$ values and pattern repetition, using a compact 3-bit encoding to minimize area and energy costs while interfacing with either DRAM- or MC-side IPs. The key contributions include defining the max exposure metric, introducing the $S_{t_{RC ext o TH}}$-based pattern detector, and demonstrating large MER improvements (up to 8.1× on DRAM-side and >50× on MC-side) with minimal power impact. The findings support a paradigm shift toward system-level ARFM protection that leverages RFM to coexist with existing RH defenses, offering scalable, low-overhead protection for RH attacks in modern DRAM ecosystems.

Abstract

To address the issue of powerful row hammer (RH) attacks, our study involved an extensive analysis of the prevalent attack patterns in the field. We discovered a strong correlation between the timing and density of the active-to-active command period, ${tRC}$, and the likelihood of RH attacks. In this paper, we introduce MARC, an innovative ARFM-driven RH mitigation IP that significantly reinforces existing RH mitigation IPs. MARC dynamically adjusts the frequency of RFM in response to the severity of the RH attack environment, offering a tailored security solution that not only detects the threats but also adapts to varying threat levels. MARC's detection mechanism has demonstrated remarkable efficiency, identifying over 99\% of attack patterns. Moreover, MARC is designed as a compact hardware module, facilitating tight integration either on the memory controller-side or DRAM-side within the memory system. It only occupies a negligible hardware area of 3363~\textit{$μm^2$}. By activating ARFM based on MARC's detection, the additional energy overhead is also negligible in normal workloads. We conduct experiments to compare the highest row count throughout the patterns, defined as max exposure, between the vanilla RH mitigation IPs and the MARC-enhanced versions of the same IPs, focusing on both DRAM-side and memory controller-side. On the DRAM-side, MARC + probabilistic scheme and MARC + counter-based tracking scheme achieve 8.1$\times$ and 1.5$\times$ improvement in max exposure ratio compared to the vanilla IPs, respectively. On the memory controller-side, the MARC + PARA and MARC + Graphene achieve 50$\times$ and 5.7$\times$ improvement in max exposure ratio compared to the vanilla IPs, respectively. MARC ensures optimal security without sacrificing system performance, making MARC a pioneering solution in the realm of RH attack mitigation.

Figures (19)

• Figure 1: DRAM Refresh Operation
• Figure 2: RFM Operation Flow
• Figure 3: (a) ARFM and DRFM (b) ARFM Level
• Figure 4: Key Timing Parameters of DRAM
• Figure 5: Max Exposure