Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Quantifying Memory Cells Vulnerability for DRAM Security

Zilong Hu, Hongming Fei, Prosanta Gope, Jack Miskelly, Owen Millwood, Biplab Sikdar

Abstract

Dynamic Random Access Memory (DRAM) is pervasive in computer systems. Cell vulnerabilities caused by unintended phenomena (forced retention failure, latency alteration, rowhammer and rowpress) lead to unintended bit flips in memory. These phenomena have been explored as attacks to violate data integrity and confidentiality during normal operation, but also exploited as a benefit in security systems as a method to generate random secret keys and unique device fingerprints (e.g. Physically Unclonable Functions). In both cases, attackers may wish to exploit knowledge of individual cell flip vulnerability to predict the current/future data contents of a set of cells, which can be utilised to break security systems. In this work, we develop a quantitative, cell-level circuit framework that models DRAM vulnerability directly from its physical charge leakage and disturbance pathways. By linking these device-layer behaviours to system-level security properties, our framework enables systematic evaluation of DRAM with respect to volatility (retention), integrity (disturbance-induced modification), and confidentiality (pattern-dependent leakage). We further demonstrate how the framework can be applied to well-known failure modes, revealing non-uniform and context-dependent vulnerability patterns. This work provides both theoretical foundations and practical evaluation tools for evaluating the suitability of DRAM use within security applications.

Quantifying Memory Cells Vulnerability for DRAM Security

Abstract

Dynamic Random Access Memory (DRAM) is pervasive in computer systems. Cell vulnerabilities caused by unintended phenomena (forced retention failure, latency alteration, rowhammer and rowpress) lead to unintended bit flips in memory. These phenomena have been explored as attacks to violate data integrity and confidentiality during normal operation, but also exploited as a benefit in security systems as a method to generate random secret keys and unique device fingerprints (e.g. Physically Unclonable Functions). In both cases, attackers may wish to exploit knowledge of individual cell flip vulnerability to predict the current/future data contents of a set of cells, which can be utilised to break security systems. In this work, we develop a quantitative, cell-level circuit framework that models DRAM vulnerability directly from its physical charge leakage and disturbance pathways. By linking these device-layer behaviours to system-level security properties, our framework enables systematic evaluation of DRAM with respect to volatility (retention), integrity (disturbance-induced modification), and confidentiality (pattern-dependent leakage). We further demonstrate how the framework can be applied to well-known failure modes, revealing non-uniform and context-dependent vulnerability patterns. This work provides both theoretical foundations and practical evaluation tools for evaluating the suitability of DRAM use within security applications.
Paper Structure (51 sections, 28 equations, 7 figures, 2 tables, 2 algorithms)

This paper contains 51 sections, 28 equations, 7 figures, 2 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Related Work
  3. Motivation
  4. Our Contributions
  5. Preliminaries
  6. DRAM Cell Vulnerabilities and Attack Surfaces
  7. P-well Leakage ($I_1$)
  8. Intrinsic Leakage
  9. Electron Injection Leakage
  10. Bitline Leakage ($I_2$)
  11. Sensing Noise
  12. Subthreshold Leakage
  13. Threat Model
  14. Security Properties
  15. Abstract Adversary Capabilities
  16. ...and 36 more sections

Figures (7)

  • Figure 1: An overview of DRAM organization. Independent cell capacitors share substrate, BL, and WL, inducing pattern-dependent coupling. Scenario ➀ and ➁ represent two attack case studies as discussed in Section \ref{['sec4:memory_model']}.
  • Figure 2: DRAM cell leakage paths under retention and read disturbance.
  • Figure 3: Equivalent Leakage Circuit.
  • Figure 4: The total leakage conductance $G_{\text{tot}}$ under Rowhammer vs Rowpress.
  • Figure 5: Relative Pattern Lever $\Delta G_{\mathrm{rel}}$ under Rowhammer vs Rowpress.
  • ...and 2 more figures