Device and method for protecting memory

Abstract

An embodiment of the present invention provides a memory device (100), comprising a memory (1), the memory (1) comprising at least one chip (2), each chip (2) comprising one or more memory banks (10) for storing a plurality of bits, each memory bank (10) comprising a set of rows (13) and columns (14), each row and each column comprising a plurality of bits, the device further comprising: a controller (102), which is configured to generate: an access command to the memory (1), an access command identifying an address corresponding to a given row of the memory (1), and a command operation to be performed on the given row, wherein the device further comprises a protection device. The protection device (3) is configured to transform the address into a transformed address in response to receiving the access command identifying the address. The protection device (3) uses an address storage data structure (30) (e.g., a histogram) to store the transformed address in accordance with the frequency of access associated with the address, the address storage data structure being reset in response to a memory protection operation (e.g., refresh) performed in the memory device. The protection device (3) also includes: an access frequency manager (32), which is configured to determine whether an access frequency associated with an address maintained in the address storage data structure is greater than or equal to a threshold, and if the access frequency is greater than or equal to the threshold, trigger a memory protection operation in the memory (1) from within the memory.

Description

Technical Field

[0001] The present invention generally relates to memory devices, and more particularly to a device and method for protecting a memory having a function of protecting the memory. Background Art

[0002] As processing performance increases, modern computing systems and devices require more and more memory capacity. In particular, memories with memory protection functions (e.g., refresh) are widely used in various high-speed and memory-demanding applications (e.g., graphics cards), as well as networking and communication applications that perform various tasks.

[0003] However, such memories are vulnerable to certain types of side channel attacks. For example, double data rate (DDR) memories are particularly vulnerable to fault injection attacks, which consist in injecting intentional (or "malicious") faults into DDR memories using injection techniques and observing the corresponding error outputs to extract or modify information stored on the memory. One type of fault injection attack is called a row hammer attack. Row hammer attacks can include basic row hammer attacks or their variations: double-sided row hammer attacks. Row hammer attacks can cause failures in DDR memories by repeatedly accessing a single row of memory within the refresh window of the memory cell. Therefore, there is a very high probability that word lines that are physically adjacent to the accessed row will be corrupted. Row hammering can cause DDR memory cells to leak their charge and electrical interactions to occur between DDR memory cells, which may cause changes to the contents of nearby memory rows (physically adjacent rows that were not accessed) that were not addressed in the original memory access due to excessive number of accesses to the DDR memory between two refreshes.

[0004] The row hammer attack accordingly uses fast row activation of accessed cells, which can result in changes in the values ​​of bits stored in adjacent rows that are not accessed. Thus, the row hammer attack exploits DDR defects to gain unrestricted access to DDR contents, thereby allowing unauthorized read / write access to DDR memory.

[0005] There are different techniques for preventing the occurrence of the row hammer effect. Some existing solutions are based on error correction codes (ECC), on frequent refreshes of all rows, or on probabilistic adjacent row activation (PARA), as disclosed in, for example, the following documents:

[0006] - Yoongu Kim; Ross Daly; Jeremie Kim; Chris Fallin; Ji Hye Lee; Donghyuk Lee; Chris Wilkerson; Konrad Lai; Onur Mutlu (June 24, 2014), “Flipping Bits in Memory Without Accessing Them: An Experimental Study of DRAM Disturbance Errors,” Ece.cmu.edu.IEEE., retrieved March 10, 2015.

[0007] -Mark Seaborn; Thomas Dulien (March 9, 2015), “Exploiting the DRAM rowhammer bug to gain kernel privileges”, Googleprojectzero.blogspot.com. Google, retrieved March 10, 2015.

[0008] - Sarani Bhattacharya; Debdeep Mukhopadhyay (August 4, 2016), “Curious Case of Rowhammer: Flipping Secret Exponent Bits using Timing Analysis,” eprint.iacr.org / 2016, retrieved November 6, 2017.

[0009] However, such an approach is expensive. In particular, although ECC allows repair of bit flips, ECC-based protection against row hammer attacks requires storage space dedicated to ECC. Therefore, protection scales linearly with the amount of memory. In addition, the detection capability is limited (at most two error bits) and expensive (because a portion of the memory is dedicated to ECC, protection scales linearly with the amount of memory). For example, to add ECC to the conventional DDR3 DIMM standard 64 bits (8×8), 72 bits (8×9) must be used.

[0010] Moreover, ECC-based protection against row hammer attacks is only a security protection in the sense that it does not provide protection against a determined attacker. Therefore, this requires verification on the CPU side of the DDR chip (e.g., additional ECC). Therefore, ECC-based solutions do not allow to protect the CPU of the DDR chip. Therefore, the DDR chip is not secure.

[0011] Furthermore, although solutions based on frequent refreshing of all rows and solutions based on probabilistic neighbor row activation (PARA) present lower area overhead, they have a high cost in terms of performance.

[0012] In fact, in the case of frequent refreshes of all rows, the system cannot access the memory while it is in the refresh state. Therefore, increasing the duration between two refreshes is usually performed by the manufacturer.

[0013] In the Probabilistic Adjacent Row Activation (PARA) approach, in an attempt to reduce the cost in terms of performance, refreshes are activated only on specific rows, which correspond to rows adjacent to rows that are accessed with a low probability. However, such a solution requires the generation of unnecessary refreshes and therefore has an additional cost in terms of performance.

[0014] Therefore, conventional approaches for preventing the row hammer effect are based either on making the DDR chip natively resistant to row hammer attacks or on expensive upstream detection of row hammer attacks.

[0015] Therefore, there is a need for improved protection of memories having memory protection functionality against row hammer attacks. Summary of the invention

[0016] To overcome these and other problems, a memory device is provided, comprising a memory, the memory comprising at least one chip, each chip comprising one or more memory banks for storing a plurality of bits, each memory bank comprising a set of rows and columns, each row and each column comprising a plurality of bits, the device further comprising: a controller configured to generate: an access command to the memory, an access command identifying an address corresponding to a given row of the memory, and a command operation to be performed on the given row. The memory device further comprises a protection device, the protection device comprising:

[0017] - a transformation unit configured to apply a transformation function in response to receipt of an access command identifying an address to transform said address into a transformed address;

[0018] - an address storage data structure configured to store transformed addresses depending on a frequency of accesses associated with the addresses, the address storage data structure being reset in response to a memory protection operation performed in the memory device.

[0019] The protection device also includes an access frequency manager configured to determine whether an access frequency associated with an address maintained in the address storage data structure is greater than or equal to a threshold, and to trigger a memory protection operation in the memory from within the memory if the access frequency is greater than or equal to the threshold.

[0020] In one embodiment, the protection device may include at least one access counter configured to count access commands associated with a given address between two memory protection operations of the memory, the frequency of accesses associated with the address being determined using the counter value.

[0021] In some embodiments, the protection device may include an access counter associated with each address.

[0022] The memory device may operate in terms of clock cycles, and the transformation function may be a balanced and non-injective function defined from the memory size to α(N / H) words, where α is an integer strictly greater than 1, N represents the number of clock cycles between two memory protection operations, and H represents the average number of times a row hammer attack should access an address to cause it to fail.

[0023] In one embodiment, the transformation function may be a hash function or an encryption function.

[0024] In particular, the transform function can be configured to process one address per clock cycle.

[0025] Advantageously, the protection device 3 may also comprise a scrambler configured to scramble at least some selected bits of the address identified in the access command received by the memory.

[0026] The selected bits may include the least significant bits of the address.

[0027] In one embodiment, address scrambling by the scrambler may be triggered based on a condition related to a frequency of accesses associated with the address.

[0028] In some embodiments, the memory device may include a processor, and the address scrambling by the scrambler is triggered by the processor of the memory device.

[0029] Address scrambling by the scrambler may be performed using a bit sequence generated by an embedded random number generator.

[0030] In one embodiment, the scrambler may implement permutation of the least significant bits (LSBs) of the address.

[0031] The scrambler may use a random codeword selected from a linear affine code having a minimum distance higher than or equal to a predefined value d.

[0032] In some embodiments, the protection device may be implemented in the memory or the controller.

[0033] In one embodiment, the memory protection operation may be a refresh operation.

[0034] A method for protecting a memory is also provided, the memory comprising at least one chip, each chip comprising one or more memory banks for storing a plurality of bits, each memory bank comprising a set of rows and columns, each row and each column comprising a plurality of bits, the device further comprising: a controller configured to generate: an access command to the memory, an access command identifying an address corresponding to a given row of the memory, and a command operation to be performed on the given row. Advantageously, the method may include:

[0035] - in response to receiving an access command identifying an address, applying a transformation function configured to transform the address into a transformed address;

[0036] - Storing the transformed address in an address storage data structure depending on a frequency of accesses associated with the address, the address storage data structure being reset in response to a memory protection operation performed in the memory device.

[0037] The method also includes determining whether an access frequency associated with an address maintained in the address storage data structure is greater than or equal to a threshold, and triggering a memory protection operation in the memory from within the memory if the access frequency is greater than or equal to the threshold.

[0038] Various embodiments of the present invention provide DDR memories that are resistant to row hammer attacks, which eliminates the need for upstream detection of attacks. In addition, DDR memories according to embodiments of the present invention make row hammer attacks very difficult to exploit in a quantifiable manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate various embodiments of the invention and, together with the general description of the invention given above and the detailed description of the embodiments given below, serve to explain embodiments of the invention.

[0040] Figure 1 is a diagrammatic view of a memory device.

[0041] Figure 2 is a diagrammatic view of a memory device according to some embodiments.

[0042] Figure 3 An exemplary operating environment is depicted in which a memory device may be implemented according to one embodiment.

[0043] Figure 4 An exemplary double-sided hammer attack is shown.

[0044] Figure 5 is a logic circuit representing a protection device according to an exemplary hardware implementation.

[0045] Figure 6is a flow chart depicting a protection method implemented by a protection device according to some embodiments.

[0046] Figure 7 A scrambler according to an exemplary embodiment of the present invention is depicted. DETAILED DESCRIPTION

[0047] refer to Figure 1 , shows a memory device 100 according to some embodiments of the present invention.

[0048] The memory device 100 comprises a memory 1 organized as a matrix, where data bits are stored at the intersections of rows and columns.

[0049] More specifically, the memory 1 may include one or more chips (or modules) 2, each chip (or module) 2 having a multi-bank architecture. Figure 1 Only one chip 2 is shown in FIG. 1 . Each chip 2 may include one or more memory banks 10 for storing a plurality of bits. Each memory bank 10 has a size of n×p and includes a set of rows 13 and columns 4. Thus, each row 13 (also referred to as a “line”) includes a number of bits defined by the row size n, and each column 14 includes a number of bits defined by the column size p.

[0050] The memory 1 may be any memory having a memory protection function such as a refresh function or the like. The memory 1 may be, for example, a volatile memory, for example, a RAM-based memory, which may be, for example, a DRAM memory or a DDR memory. For illustrative purposes only, some embodiments of the present invention will be described below with reference to a DDR type memory 1. However, the skilled person will readily appreciate that the present invention is generally applicable to any memory having a refresh function.

[0051] The memory protection function specifies any function (or operation) that can be implemented to protect the memory to prevent or stop memory degradation, for example, a function or a refresh function that cuts off access to the memory. As used herein, a refresh function (or refresh operation) specifies a function that resets the state of the memory.

[0052] For illustrative purposes only, some embodiments will be described below primarily with reference to memory protection operations of the refresh operation type. However, those skilled in the art will readily appreciate that the present invention is generally applicable to memory protection functions or operations.

[0053] The rows 13 can be selected by horizontal word lines. Each row includes one or more transistors. In response to receiving a logic high signal, the transistors of the row are enabled and the storage capacitors are connected to the corresponding vertical bit lines. The vertical bit lines are connected to a sense amplifier that provides an amplified signal by amplifying the small voltage changes generated by the storage capacitors. The memory device 100 then outputs the amplified signal and the bit lines are driven back to refresh the rows. If no word lines are active, the memory array is idle and the bit lines are maintained in a precharged state.

[0054] To access the memory, a row must first be selected and loaded into the sense amplifiers. Then, the row becomes active and the columns can be accessed for reading or writing.

[0055] The memory 1 may further include a row buffer 15 associated with each memory bank 10. The memory device 100 may further include a memory device controller 102 to control activation of the memory bank row 3 and read / write operations.

[0056] Each memory bank 10 is addressable by both a row address and a column address.

[0057] The memory device controller 102 may issue an activate command to activate a given row in a specified memory bank 10. To activate a given row 13 of a memory bank 10 identified by a row address, the requested row may be activated and copied to a row buffer 15 associated with the given row of the memory bank 10. The memory device 10 may be set to an active state in response to an active command.

[0058] In the active state of the memory device 100, read and / or write operations may be performed. To perform a read and / or write operation, a data burst may be issued to an activated row.

[0059] Column 14 may be used during a read or write command to point to a specific address within an open page for a read / write operation. As used herein, a "page" (or "memory page") refers to a block of data stored within the same row of DDR 1.

[0060] To address a row (memory page) of a DDR memory, a command may specify a memory bank 10 and a row address. When a memory bank 10 is active, an "open" page is associated with the bank's buffer 15.

[0061] The page remains open in buffer 15 until a different page needs to be opened to access a different address.

[0062] A read command may be issued by the memory device controller 102 to initiate the reading of a burst of data to an active row. To read a burst of data stored in a given row identified by a row address, the row may be charged in the row buffer 15 and read.

[0063] In order to read from the memory 1, the controller 102 can identify the chip 2, the memory bank 10, and the row 13 to be addressed in the memory 1 by issuing an active command to the memory 1. In response to the active command, the memory 1 can output the entire row of data via one or more sense amplifiers. The addressed memory chip 2 can then accept the read command. The read command can include a column address. The memory 1 can decode the column address of the read command to select the data to be read, and output the read data using the sense amplifier. Then, in response to a precharge command issued by the memory controller 102 to the memory 1, the memory 1 can return to an idle state.

[0064] A write command may be issued by the memory device controller 102 to initiate writing of a burst of data to an active row 13. To write a burst of data to a given row 13 identified by a row address, the burst of data may be stored in a row buffer 15 and written back to the corresponding row 13.

[0065] A refresh operation may be initiated in response to a refresh command from the memory device controller 102. The refresh operation may include precharging all memory banks 10, which involves shutting down rows 13 of all memory banks 10. In response to the precharging, the memory device 10 may be set to an idle state.

[0066] The time between two refreshes of such a memory chip 10 may be fixed. After a refresh, the memory point is strong and therefore immune to hammering. After a number of new accesses, the memory point may become vulnerable to hammering again. Therefore, if the attacker manages to access (i.e., read or write) the same address a sufficient number of times between two refreshes, a row hammer attack may be effective.

[0067] The number of clock cycles between two refreshes is denoted by N. Theoretically, the memory can be accessed at most N times within this time interval. As used herein, the term "clock cycle" refers to the clock cycle according to which the DDR memory device 100 operates.

[0068] The average number of times an attack should access an address to cause the memory device 100 (or a neighbor with high probability) to fail is denoted as H. In theory, the security problem of row hammer is that H>N. Therefore, in conventional DDR memory, an attacker can inject faults in the memory device 100 by always accessing the same address. It should be noted that in practice, it is difficult to access the memory device 100 at every clock cycle because the cache memory "remembers" the data that has been accessed and immediately returns the remembered value by querying the memory device 100 again. For a row hammer attacker, the solution is to refresh the cache line, which can be repeated at a frequency of about once every hundred clock cycles. In a conservative approach, it is assumed that the row hammer attacker can access once every clock cycle. An alternative attack is called double-sided hammering, in which the attacker focuses on making address a fail by continuously accessing addresses a-1 and a+1.

[0069] Therefore, it has been determined that if the attacker cannot access an address (or an address with a distance of 2) more than H times, the attack can be stopped.

[0070] The memory device 100 according to various embodiments of the present invention improves the protection of the memory 1 from row hammer attacks including adaptive attacks.

[0071] Figure 2 A memory device 100 is depicted in accordance with some embodiments.

[0072] The memory device 100 may include a protection unit 3 configured to protect the memory device 100 from DDR type fault injection attacks. The protection unit 3 may include an accessed address storage data structure 30, for example, one or more access histograms, which are configured to maintain a list of top accessed addresses (or rows) between two refresh cycles (or more generally, between two memory protection operation cycles) for each memory chip 2 using a balanced and non-injective transformation function F, the balanced and non-injective transformation function F is configured to determine an image (also referred to as a "transformed image") of an address identified in an access command, the access command also specifying a command operation (e.g., read or write) and data to be executed at the identified address. For purposes of illustration, some embodiments will be described below with reference to a histogram type of accessed address storage data structure 30.

[0073] Although the protection device 3 is depicted as being separate from the DDR controller 102 and the memory 1 , it should be noted that in some embodiments, the protection device may be implemented in either the DDR controller 102 or the memory 1 .

[0074] To detect excessive accesses to the same address, an access histogram 30 using a shadow memory of the same size as the functional memory 1 can be used. According to this method, each address will be reset to zero at refresh and incremented (i.e., the value increases by one) at each access. If a value is equal to H, an attack is detected.

[0075] Alternatively, in order to avoid instantiation of a new shadow memory of the same size as the functional memory 1, the memory requirement may be reduced from the size of the memory 1 to be protected (which may be equal to several gigabytes) to N=H. According to this approach, the memory device 100 may use a queue-type accessed address storage data structure 30 to track the most frequent accesses and monitor any new accesses to the memory 1. In this memory reduction-based approach, the management of the queue 30 may include the following steps:

[0076] - a first step, consisting in determining, for each requested access identifying an address, whether the address has already been accessed by checking whether the address is stored in a queue;

[0077] - If yes (the address is found in the queue), then the address is suspected to be the target of the attack and is maintained in the queue, and the access counter is incremented. If the access counter is equal to H, then action can be taken.

[0078] - If the address is not already in the queue 30, then if there is some free space available, the address is inserted into the queue and the oldest accessed address(es) (meaning the oldest address(es) with the least number of accesses) are discarded to the free space.

[0079] This memory reduction based approach exploits the fact that an old access is less likely to be a target of row hammer since it is not accessed quickly enough.

[0080] However, it has been analyzed that this memory reduction-based approach is not suitable for resisting adaptive attacks. In fact, an attacker can, for example, access The address is read twice in order to fill the queue with marked frequent addresses. Any new address will pop the previous unique address. Therefore, hammering at a+1 and a-1 will not be detected, because access at a+1 will pop a-1 and vice versa. Therefore, the attack can bypass this protection.

[0081] In order to provide robust protection against row hammer attacks, the protection device 3 may include an access frequency manager 32 configured to detect when the access frequency associated with a given address is greater than or equal to a predetermined threshold from the accessed address storage data structure 30 using data related to the frequency of accesses to the address. The protection device 3 may include at least one access counter configured to determine to count access commands associated with a given address between two refreshes of the DDR memory 1, the data related to the frequency of accesses associated with the address being determined using the counter value. In one embodiment, each address may be associated with an access counter i configured to count accesses to the address between two refreshes of the DDR memory 1. If the access frequency associated with the address is greater than or equal to the predetermined threshold, the access frequency manager 32 may trigger a refresh cycle from within the memory chip 2 instead of being triggered by the controller 102. This enables detection of a row hammer attack.

[0082] In some embodiments, the memory device 100 may also include a scrambler 34 configured to scramble at least some selected bits of each address identified in an access command to prevent row hammer attacks. In one embodiment, the selected bits may include the least significant bits of each access address. Each address scrambling operation may be triggered by an access frequency associated with the address (as determined using an access counter associated with the address) and / or by a particular pattern (e.g., to prevent double-sided row hammer attacks). The protection device 3 is configured to execute an access command that identifies an address, for example, to read (if the command specifies a read operation) the data specified in the command or to write (if the command specifies a "write" operation) the data to a scrambled address in the memory 1.

[0083] Advantageously, the address scrambling may be dynamic scrambling. It may be programmed by a processor (CPU) of the memory device 100 or may be intrinsic (e.g., scrambling may be performed using a bit sequence generated by an embedded random number generator). In the case where the scrambling is programmed by the CPU, the CPU may send instructions to the scrambler to ensure address scrambling. As used herein, "intrinsic" scrambling refers to an embodiment in which the memory device 1 controls the address scrambling itself, for example, by triggering the address scrambling at each reset of the memory device.

[0084] In some applications, the memory 1 may need to be refreshed periodically (eg, every 64 ms). In conventional SDRAM, data cannot be transferred during the refresh, and the refresh may require some time (typically about 70 nanoseconds or ns).

[0085] In some embodiments, at least some components of the memory device 100 may be located on an integrated circuit IC (e.g., an application specific integrated circuit (ASIC), a programmable logic device (PLD), a field programmable gate array (FPGA), or a combination thereof). In some embodiments, the memory 1 may be external to the integrated circuit. The integrated circuit may include a memory controller 102.

[0086] The memory device controller 102 may include a request buffer 1020 configured to buffer requests to be sent to the memory 1 and a response buffer 1021 configured to buffer responses received from the memory 1 .

[0087] The memory device controller 102 may also include a memory mapper 1022 configured to decode the memory address identified by the memory request into a triplet of data identifying the corresponding memory bank 10, row 13, and column 14. The memory bank 10 may be identified by an integer (from 0 to K, K-1 represents the number of memory banks). Each row 13 may be identified by an integer i ranging from 0 to n-1. Each column 14 may be identified by a binary number (e.g., "00", "01", "10", "11") representing the position of the column.

[0088] A memory address has a predefined bit length (e.g., 32 bits). A memory address may include:

[0089] - a byte offset, which has a predefined length (e.g., 3 bits in length);

[0090] - a bank selection having a predefined bit length depending on the number of banks;

[0091] - a chip select having a predefined length depending on the number of chips used by the memory;

[0092] - Column selection, which varies depending on memory size and type;

[0093] - Row selection, which varies depending on memory size and type;

[0094] The memory device controller 102 may further include: a command generator 1022 for generating (a plurality of) commands to the memory device 1; a memory arbiter 1021 configured to manage the order in which the received requests access the memory 1 depending on the arbitration scheme; and a data path (not shown) configured to send the responses received from the memory device 1 to the response buffer of the memory controller 102. Although the memory arbiter 1021 is Figure 11021 is shown as residing in the memory controller 102, but a skilled person will readily appreciate that the memory arbiter 1021 may reside in other components of the computer system external to the memory controller 102.

[0095] The commands generated by the command generator may identify the command operation (eg, read, write, activate) and the address corresponding to the row(s) 13 and the memory bank(s) 10 and derived from the received request.

[0096] In one embodiment, the memory device 100 may be a DDR (double data rate) based memory device, such as DDR, DDR2, DDR3 memory. DDR based memory may be referred to as "DDR memory" hereinafter.

[0097] DDR memory is configured to acquire data on both the rising and falling edges of the clock cycle, thereby doubling the data rate for a given clock frequency. For example, in a DDR2 device, the data transmission frequency is 200MHz, where the bus speed is 100MHz. Therefore, by acquiring data on both the rising and falling edges of the clock cycle, the processing rate is doubled.

[0098] DDR memory is associated with a temporization property (or temporal number) which represents the number of clock pulses it takes the DDR memory to perform a given operation. The temporal property is represented by a number, the smaller the number, the faster the memory.

[0099] A temporary number can be associated with one of the following operations:

[0100] - "CL" or "Column Address Strobe" (CAS) latency, which represents the amount of time in clock cycles between the time the memory device controller 102 asks the memory 1 to access a specified memory column and the time the requested data is returned (if a row has been selected, it is the number of clock cycles required after the column address is sent to the memory device controller before the result is returned).

[0101] - "tRCD" or "Row Address Strobe (RAS) to CAS Delay," which represents the amount of time in cycles between the time a row is activated and the time a column is activated via the CAS signal and data can be written to or read from the memory cell.

[0102] - "tRP" or "RAS Precharge", which represents the number of cycles required to disable a row access and start the next row access.

[0103] - "tRAS" or "Active to Precharge Delay" between Active and Precharge commands, ie the number of clock cycles the memory device has to wait until the next access to the memory can be initiated.

[0104] - "CMD" or "Command Rate," which represents the number of clock cycles between memory device activation and the time when the first command can be sent to the memory device.

[0105] When data is needed, controller 102 may activate the RAS line to specify the row for which data is needed, and then activate the CAS line to specify the column.

[0106] Figure 3 An exemplary operating environment in which the memory device 100 may be implemented is shown. The operating environment may include a CPU 20 and a memory device 100 having a memory 1 such as a DDR memory. The memory 1 may be used to store application programs that may be executed by the CPU 20.

[0107] A row of memory 1 may be accessed via a row address specified by memory controller 102. Then, a column address of the data being addressed may be provided. Another column address may be used to access other data within the row without providing a row address again (referred to as a "page hit"). In some embodiments, it is not required to provide a row address for each column access.

[0108] The CPU 20 may initiate a read request to transfer data from the memory 1 to the CPU 20 or a write request to transfer data from the CPU to the memory 1. A memory request (e.g., a read or write request) may be associated with auxiliary information (e.g., information identifying the type of command (read or write), or a priority indicator identifying the priority of the request). The auxiliary information may be included in the memory request or sent in a separate message using a suitable communication protocol.

[0109] The CPU 20 may be connected to a memory controller 102 via a host bus 21. The memory controller 102 may be connected to the memory 1 via a memory bus 22. In some embodiments, the memory controller 102 may also be connected to a graphics controller 24, which is configured to manage access (storage or retrieval operations) to a frame buffer storing graphics data, so as to manage the presentation of such data on a graphical user interface. The graphical user interface may be generated on any type of display device 25.

[0110] The memory controller 102 may be connected to an I / O (input / output) controller 26 via an interface. The I / O controller may include an interface to I / O devices. The I / O controller 26 may be configured to route I / O data transfers.

[0111] Various embodiments of the present invention provide protection against a fault injection attack (eg, a row hammer attack or a variation thereof (eg, a double-sided row hammer attack)) that uses a large number of accesses to a memory (1) between two refreshes to cause errors in the memory.

[0112] like Figure 4 As shown in Figure 4 An exemplary double-sided hammer attack is depicted, which is commonly used (e.g., in row 13 i-1 and 13 i+1 ) fast row activation, which attempts to change the value stored in the row 13 that is activated i-1 and 13 i+1 Adjacent target row 13 i The value of the bit in .

[0113] Embodiments of the present invention exploit a chance fault of an attacker, rather than expensive detection of such an attack.

[0114] In one embodiment, to avoid the size expansion of histogram 30, the size of the histogram can be set to N / H, where N represents the number of clock cycles between two refreshes (theoretically, the memory can be accessed at most N times in such a time interval), and H represents the average number of times an attack will access an address to cause memory device 100 (or a neighbor with a high probability) to fail.

[0115] The balancing function F applied by the protection device 3 to the top accessed row may be derived from the memory size (e.g., 2 64 words) to α(N / H) words, α being an integer strictly greater than 1. For example, α may be equal to 10. As used herein, the term "balanced" indicates that the number of any preimages of a function is the same. For example, if α(N / H)=2 m , then there are exactly 2 64-m words are mapped to [0; α(N / H) = 2 m Each histogram bin in [. If the N accesses are random, then we can expect the counters in [0; α(N / H)[ to all be equal to H / α. In fact,

[0116] Assuming the attacker performs a row hammer attack, the attacker will need to hit a unique address at least H times. Therefore, for one input in the histogram, there will be a value better than or equal to H (≥H) where the expected value is closer to H / α. Such a value (hit ≥H times) stands out in the histogram and proves a row hammer attempt.

[0117] In one embodiment, to detect row hammer, the access frequency manager 32 may determine whether repeated accesses to the same address cause the counter i to increment by more than an expected value H / α (since H>H / α). It should be noted that false positives may occur in such row hammer detection without actually attempting an attack. This may occur, for example, if a benign program performs accesses in a set of preimages for a given histogram input. To avoid such false positives, the non-injective mapping performed by the balancing function F may be random, making it unpredictable to an attacker.

[0118] In some embodiments, function F can be configured to process one address per clock cycle. Mapping function F can be "pipelined", meaning that the process of transforming the top visited address can be initiated in one clock cycle, even if the final result is output only after multiple clock cycles. In one embodiment, function F can also be "fully combinatorial", meaning that the process of transforming the top visited address is terminated in one clock cycle.

[0119] In one embodiment, function F may be a hash function (e.g., a keyed hash function) configured to truncate its output (the output of function F) to an expected bit width. This prevents an attacker from performing a second preimage attack that would allow the attacker to always hit the same entry in a hash table (hash table refers to a hash table used in conjunction with the hash function).

[0120] Alternatively, function F may be an encryption function configured to compute lightweight encryption on the accessed address and discard bits produced by such computation to match the desired bit width. Function F may be based on an encryption algorithm. Since encryption algorithms are locally keyed, they respect confidentiality constraints on attackers.

[0121] Function F can be, for example, a lightweight cryptographic function, such as function PRESENT (PRESENT: An Ultra-Lightweight Block Ciphe by Andrey Bogdanov, Lars R. Knudsen, Gregor Leander, Christof Paar, Axel Poschmann, Matthew JB Robshaw, Yannick Seurin and Charlotte Vikkelsoe (CHES, LNCS Vol. 4727, pp. 450-466, Springer, September 10-13, 2007, Vienna, Austria)) or a mature encryption function, such as AES (Advanced Encryption Standard).

[0122] Using a hash function or encryption function as function F to transform the top visited addresses is particularly advantageous, since such a function is iterative and can therefore be pipelined.

[0123] In another embodiment, the function F may be to convert the top visited address (e.g., 2 64 addresses) to a set of size p, where p is a secret random prime number chosen to be less than α(N / H) and close to α(N / H). This mapping therefore corresponds to a reduction modulo p.

[0124] In response to determining that the access frequency exceeds a given threshold, the access frequency manager 32 may trigger a refresh cycle from within the memory 1 .

[0125] The scrambler 34 may perform address scrambling in parallel or in any sequential order relative to the operation of the access frequency manager 32 .

[0126] Since a row hammer attack tends to be deterministic, by using a scrambler 34, the address data may be disrupted or linearly mixed, thereby preventing an attacker from predicting the effects of a fault.

[0127] In one embodiment, scrambler 34 may perform a permutation of at least some of the address bits of a given address. The permutation may be performed on the least significant bit (LSB) of the address. The number of bits may vary depending on the desired level of protection and performance needs. With this protection, an attacker must re-find where the target row ("victim" row) is located in memory and which addresses are adjacent after each scrambling.

[0128] Figure 5 is a logic circuit representing the protection device 3 according to an exemplary hardware implementation.

[0129] The protection device 3 comprises a logic OR gate 300 which receives and inputs a refresh signal and a counter value “count i”.

[0130] like Figure 5 As shown in FIG. 1 , if a row hammer attack is detected, the DDR memory 1 is forced to refresh by performing an OR operation (logical OR gate 300) between the refresh line 301 and the external refresh wire 302, thereby causing the DDR memory 1 to refresh earlier than expected. It should be noted that in most DDR memories, the refresh rate cannot usually be controlled. The DDR controller 102 ensures such control of the refresh rate. However, the protection device 3 implements multiple logics (300, 301, 302) to be able to trigger (or force) a refresh.

[0131] The protection device may implement a preventive countermeasure orthogonal to the detection of a hammer attack by using a scrambler 34. The scrambler 34 may be configured to scramble the least significant bits (LSBs) of the accessed addresses. In one embodiment, the scrambler 34 may implement a bijective scrambling algorithm. An exemplary scrambling algorithm may consist in selecting a random codeword from a linear affine code (as used herein, an affine code is a coset of a linear code that maps zero (0) values ​​to zero (0) values) whose minimum distance is greater than or equal to a certain value d. Such a scrambler 34 avoids direct neighbors with a distance of 2 d The probability of <<1 is “row hammered.” However, the present invention is not limited to this scrambling algorithm, and various bijective scrambling algorithms may be applied.

[0132] It should be noted that the steps of constructing the histogram 32 and performing physical access scrambling (as implemented by the scrambler 34) may be computed in parallel, thereby combining their security gains without negatively impacting performance.

[0133] In addition, although described jointly in the present application, it should be noted that certain aspects of the present invention may be independently protected. In particular, the step of transforming the accessed address using function F before storing the transformed address in histogram 30 and the step of performing physical access scrambling (such as implemented by scrambler 34) may be implemented independently in different implementations.

[0134] Figure 6 is a flow chart describing a protection method implemented by a protection device according to some embodiments.

[0135] In step 601 , in response to a refresh (block 600 ), the entries of the histogram 30 are reset, ie, initialized to zero values ​​(reset step).

[0136] In step 603, in response to receiving an access command requesting access to a given address (block 602), an access counter i associated with that address is incremented.

[0137] In step 604, the image of the address identified in the command is determined by applying the transformation function F.

[0138] In step 605, the addressed images (also referred to as "transformed addresses") are stored in a histogram.

[0139] In step 606, the address identified in the command received in step 603 may be scrambled. It should be noted that although step 606 is shown as being performed sequentially after step 605, alternatively, step 606 may be implemented in parallel with any one of steps 604 and 605.

[0140] In step 607, data corresponding to the access command is read (R) or written (W) to the row corresponding to the scrambled address, depending on the operation (eg, read or write) identified in the access command.

[0141] Figure 7 A scrambler 34 according to an exemplary embodiment of the present invention is depicted.

[0142] exist Figure 7 In the example of , the scrambler 34 is configured to apply a permutation transformation to the least significant bits of the accessed address. In another embodiment, the scrambling may be performed, for example, by swapping a less accessed line with another line not in the counter list.

[0143] The operation of scrambling the accessed addresses may be triggered each time the system is started.

[0144] Alternatively, the scrambling of the accessed addresses may be triggered by the access frequency manager 32. For example, Figure 7 In the embodiment of the present invention, the access frequency manager 32 can be implemented by a finite state machine FSM, which is configured to: determine whether the access frequency is associated with the accessed address stored in the histogram 30; determine whether the access frequency associated with the accessed address is greater than or equal to a predetermined threshold TH, and if the access frequency is greater than or equal to the predetermined threshold TH, then:

[0145] - triggering a refresh cycle of the DDR memory from within the DDR memory; and / or

[0146] - Triggering scrambling (eg, permutation) of accessed addresses.

[0147] Therefore, the DDR memory 1 maintains scrambled addresses to make it difficult for an attacker to hammer a row next to a row targeted for attack during his attack.

[0148] Embodiments of the present invention improve the protection of DDR memory. Embodiments of the present invention can be implemented on DDR memory 1 or DDR memory controller 102. Embodiments of the present invention can take the form of embodiments that include only software, only hardware, or both hardware and software elements. For example, embodiments can be implemented in CMOS logic. Embodiments of the present invention can be easily integrated into any DDR device. They provide quantifiable security gains. They make it difficult for attackers to identify which lines are physically adjacent to lines that are subject to row hammer attacks. Therefore, the protection method and device according to the embodiments of the present invention ensure efficient deterrent protection against row hammer attacks. Although the protection method and device according to the embodiments of the present invention can be applied to other types of attacks, they are particularly effective for fault injection attacks due to the randomization of RAM layout.

[0149] The methods described herein can be implemented by computer program instructions supplied to a processor of any type of computer to produce a machine having a processor that executes instructions to implement the functions / behaviors specified herein. These computer program instructions can also be stored in a computer-readable medium that can instruct a computer to operate in a particular manner. To this end, the computer program instructions can be loaded onto a computer to cause the execution of a series of operating steps, thereby producing a computer-implemented process so that the executed instructions provide a process for implementing the functions specified herein.

[0150] It should be noted that the functions, actions and / or operations specified in the flow chart, sequence diagram and / or block diagram can be reordered, processed in series and / or processed simultaneously in accordance with the embodiments of the present invention. In addition, any one of the flow chart, sequence diagram and / or block diagram may include more or less blocks than those shown in accordance with the embodiments of the present invention.

[0151] Although embodiments of the present invention have been illustrated by the description of various embodiments, and although these embodiments have been described in considerable detail, it is not the intention of the applicant to restrict or in any way limit the scope of the appended claims to such detail. Additional advantages and modifications will readily occur to those skilled in the art. Therefore, the invention in its broader aspects is not limited to the specific details, representative methods, and illustrative examples shown and described.

Claims

1. A memory device (100), comprising a memory (1), the memory (1) comprising at least one chip (2), each chip (2) comprising one or more memory banks (10) for storing a plurality of bits, each memory bank (10) comprising a set of rows (13) and columns (14), each row and each column comprising a plurality of bits, the device further comprising: A controller (102) configured to generate: an access command to the memory (1), an access command identifying an address corresponding to a given row of the memory (1), and a command operation to be performed on the given row, wherein the device further comprises a protection device, the protection device (3) comprising: - a transformation unit (31) configured to apply a transformation function in response to receiving an access command identifying an address to transform said address into a transformed address; - an address storage data structure (30) configured to store the transformed address in dependence on a frequency of accesses associated with the address, the address storage data structure being reset in response to a memory protection operation performed in the memory device; The protection device (3) also includes: an access frequency manager (32), which is configured to determine whether an access frequency associated with an address maintained in the address storage data structure is greater than or equal to a threshold, and if the access frequency is greater than or equal to the threshold, trigger a memory protection operation in the memory (1) from within the memory, wherein the access frequency manager includes an access counter, the access counter is configured to count accesses to the address between two memory protection operations in the memory to provide a counter value, the access frequency associated with the address is determined using the counter value, wherein the memory protection operation is a refresh operation.

2. The memory device according to claim 1, wherein: The protection device (3) comprises at least one access counter, which is configured to count access commands associated with a given address between two memory protection operations of the memory (1), the frequency of accesses associated with the address being determined using the counter value.

3. The memory device according to claim 2, wherein: The protection device (3) comprises an access counter associated with each address.

4. The memory device (100) according to any one of the preceding claims, wherein The memory device (100) operates according to clock cycles, and the transformation function is a balanced and non-injective function defined from the memory size to α(N / H) words, α being an integer strictly greater than 1, N representing the number of clock cycles between two memory protection operations, and H representing the average number of times a row hammer attack should access an address in order to cause it to fail.

5. The memory device (100) of claim 1, wherein: The transformation function is a hash function or an encryption function.

6. The memory device (100) of claim 1, wherein: The transform function is configured to process one address per clock cycle.

7. The memory device (100) of claim 1, wherein: The protection device (3) further comprises a scrambler (34) configured to scramble at least some selected bits of an address identified in an access command received from the memory (1).

8. The memory device (100) of claim 7, wherein: Address scrambling by the scrambler (34) is triggered based on a condition related to a frequency of accesses associated with the address.

9. The memory device (100) of claim 7, wherein: The memory device (100) comprises a processor, and the address scrambling performed by the scrambler (34) is triggered by the processor of the memory device (100).

10. The memory device (100) of claim 7, wherein: The address scrambling by the scrambler (34) is performed using a bit sequence generated by an embedded random number generator.

11. The memory device (100) according to any one of the preceding claims 7 to 10, wherein: The selected bits include the least significant bits of the address.

12. The memory device (100) of claim 11, wherein: The scrambler (34) performs permutation of the least significant bits (LSBs) of the address.

13. The memory device (100) of claim 7, wherein: The scrambler (34) uses a random codeword selected from a linear affine code having a minimum distance higher than or equal to a predefined value d.

14. A method for protecting a memory (1) included in a memory device (100), the memory comprising at least one chip (2), each chip (2) comprising one or more memory banks (10) for storing a plurality of bits, each memory bank (10) comprising a set of rows (13) and columns (14), each row and each column comprising a plurality of bits, the memory device further comprising: A controller (102) configured to generate: an access command to the memory (1), an access command identifying an address corresponding to a given row of the memory (1), and a command operation to be performed on the given row, wherein the method comprises: - in response to receiving an access command identifying said address, applying a transformation function, said transformation function being configured to transform the address into a transformed address; - storing the transformed address in an address storage data structure (30) depending on a frequency of accesses associated with the address, the address storage data structure being reset in response to a memory protection operation performed in the memory device; The method also includes: determining whether an access frequency associated with an address maintained in the address storage data structure is greater than or equal to a threshold, and if the access frequency is greater than or equal to the threshold, triggering a memory protection operation in the memory (1) from within the memory, wherein the access frequency determination step includes: using a counter to count accesses to the address between two memory protection operations of the memory to provide a counter value, the access frequency associated with the address is determined using the counter value, wherein the memory protection operation is a refresh operation.

Images