Preventing ram access pattern attacks through selective data movement

Abstract

Aspects of the disclosure relate to techniques for minimizing the impact of row hammering and induced charge leakage. In an example, systems and methods for preventing access pattern attacks in random access memory (RAM) are provided. In some aspects, a data request associated with a page table can be determined to be a potential security risk, and such potential security risk can be mitigated by selecting a memory region from a subset of memory regions, copying data stored in the memory region associated with a page table entry in the page table to a second memory region, disassociating the second memory region from the subset of memory regions and associating the memory region associated with the page table to the second memory region, and updating the page table entry in the page table to reference the second memory region.

Description

Background Technology

[0001] Maintaining the integrity of data stored in random access memory (RAM) is important, not only for reliability but also for security reasons. However, in some cases, RAM can be susceptible to induced charge leakage (also known as RAM interference), which can cause one or more bits in the RAM to "flip" or change from their original values ​​in response to other activity within the RAM. Such charge leakage can lead to data loss or corruption, or may introduce potential security issues (e.g., outside of an application sandbox if the bit is associated with memory access permissions). Embodiments have been described with respect to these and other general considerations. Furthermore, although relatively specific problems have been discussed, it should be understood that the embodiments are not limited to solving the specific problems identified in the background section. Summary of the Invention

[0002] This disclosure relates to techniques for preventing induced charge leakage in random access memory (RAM) that could lead to data corruption. Such attacks are commonly referred to as row hammer attacks. More specifically, this disclosure provides mechanisms for probabilistically identifying intruder rows and / or hot rows and moving and / or remapping the contents of the intruder rows and / or hot rows to other areas of RAM to prevent induced charge leakage in adjacent victim rows. In examples, the detection of intruder rows and the movement of data can be performed in software to potentially mitigate the intruder rows. Therefore, no new or upgraded hardware is required to prevent row hammer attacks and / or other induced charge leakage attacks; instead, data movement operations in software can be used to mitigate such attacks or security risks.

[0003] According to examples of this disclosure, a method for preventing access pattern attacks in random access memory (RAM) is provided. The method may include determining that a data request associated with a page table is a potential security risk, and mitigating the potential security risk by: selecting a memory region from a subset of memory regions; copying data stored in the memory region associated with a page table entry in the page table to a second memory region; unassociating the second memory region from the subset of memory regions and associating the memory region associated with the page table to the second memory region; and updating the page table entry in the page table to reference the second memory region.

[0004] According to examples of this disclosure, a method for preventing access pattern attacks in a random access memory (RAM) array is provided. The method may include determining that a data request associated with the RAM array is a potential security risk, and mitigating the potential security risk by: selecting a first row in the RAM array, the first row storing the requested data; receiving the data in a row buffer; selecting a second row from a set of rows; unassociating the second row with the row set; storing the data in the buffer into the second row; and associating the first row with the row set.

[0005] According to examples of this disclosure, a memory controller including processor-executable instructions is provided. When executed by a processor, the processor-executable instructions enable the memory controller to determine that a first address associated with access memory (RAM) is a potential security risk, and mitigate the potential security risk by: selecting a second address associated with RAM from a set of available RAM addresses, storing data retrieved from the first address into the second RAM address, deassociating the second RAM address from the set of available RAM addresses, and associating the first address with the set of RAM addresses.

[0006] This summary is provided to introduce the selected concepts in a simplified form, which will be further described in the detailed description below. This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to limit the scope of the claimed subject matter. Attached Figure Description

[0007] The following figures illustrate examples of non-limiting and non-exhaustive approaches.

[0008] Figure 1 An example of a dynamic random access memory (DRAM) module together with a central processing unit (CPU) according to an example of this disclosure is depicted.

[0009] Figure 2 Additional details are described for reading the contents of a memory array according to an example of this disclosure.

[0010] Figure 3 Additional details are depicted regarding an example of a row hammering attack according to this disclosure, which is intentionally designed to cause induced charge leakage and bit flipping or otherwise damage to information stored in the row.

[0011] Figures 4A to 4C Examples of moving and / or remapping data according to the examples of this disclosure are depicted.

[0012] Figure 5 A page table is depicted according to an example of this disclosure.

[0013] Figure 6 An example schematic diagram of a computing device for mitigating induced charge leakage caused by line hammering effect, according to an example of this disclosure, is shown.

[0014] Figure 7 A schematic diagram of an example method for moving data and remapping addresses, according to an example of this disclosure, is shown.

[0015] Figure 8 A schematic diagram of an example method for moving data and remapping addresses, according to an example of this disclosure, is shown.

[0016] Figure 9 A schematic diagram of an example method for moving data and remapping memory blocks associated with pages in a page table, according to an example of this disclosure, is shown.

[0017] Figure 10A An example user interface for configuring line hammer protection as a service to monitor at least one of a virtual machine, user, or process, according to an example of this disclosure, is depicted.

[0018] Figure 10B A data structure for indicating the association of an identifier with protected memory space, according to an example of this disclosure, is described.

[0019] Figure 11 A block diagram depicts a multi-tenant configuration according to at least one example of this disclosure.

[0020] Figure 12 This is a block diagram illustrating the physical components (e.g., hardware) of a computing device that can be used to practice various aspects of this disclosure.

[0021] Figures 13A to 13B A mobile computing device that can be used to practice embodiments of the present disclosure is shown.

[0022] Figure 14 This illustrates one aspect of the system architecture used for data processing.

[0023] Figure 15 An exemplary tablet computing device is shown that can perform one or more aspects of the disclosure herein. Detailed Implementation

[0024] In the following detailed description, reference is made to the accompanying drawings, which form a part of this detailed description, and specific embodiments or examples are illustrated therein. These aspects may be combined, other aspects may be utilized, and structural changes may be made without departing from this disclosure. Embodiments may be practiced as methods, systems, or devices. Thus, embodiments may take the form of hardware implementations, entirely software implementations, or implementations combining software and hardware aspects. Therefore, the following detailed description should not be considered limiting, and the scope of this disclosure is defined by the appended claims and their equivalents.

[0025] Data stored on random access memory (RAM) devices can be organized into arrays of rows and columns. Examples of RAM devices include, but are not limited to, dynamic random access memory (DRAM), magnetoresistive random access memory (MRAM), spin-transfer torque-magnetic random access memory (STT-RAM), and synchronous DRAM (SDRAM). In memories that rely on the storage characteristics of capacitors to store charge (such as DRAM), repeatedly applying a current to a row via an activation command can induce current in adjacent rows, thereby affecting the charge (and associated bits) of capacitors in adjacent rows. Therefore, RAM access patterns in one region of RAM can potentially affect other regions. In some cases, the software that generates the RAM access patterns may be unable to access these regions (e.g., due to software protection, processor-level protection, etc.), but this introduces security risks because the software can circumvent or potentially circumvent memory protections. These issues are also relevant to cloud computing environments, where multiple tenants may use the same computing resources (e.g., storage, processors, memory, etc.). Furthermore, as memory becomes denser, the spacing between capacitors and the thickness of the insulating material between capacitors decrease, which reduces the number of row activations required to discharge adjacent capacitors and change the desired capacitor state (e.g., "0" or "1").

[0026] Therefore, aspects of this disclosure relate to reducing the sensitivity of information stored in a RAM device to induced charge leakage. For example, the concept of row hammering involves one or more neighboring aggressor rows using an access pattern to target information residing in a victim row; the RAM access pattern can be repeatedly applied to the aggressor row to cause charge leakage in one or more capacitors of the victim row, and thus, for example, flipping from "1" to "0". A refresh command can be used to cause the RAM device to rewrite the data in each cell, for example, by restoring the capacitors to their original charge and thereby retaining the data represented by the charged and uncharged capacitors. However, since the number of activations required to flip bits decreases as RAM becomes denser, RAM remains susceptible to induced charge leakage caused by high row activation rates. According to examples of this disclosure, the likelihood of induced charge leakage caused by a large number of intentional row activations in neighboring rows can be reduced, even if it may not be completely eliminated, by moving the contents of a suspected or identified aggressor row to another location (e.g., within the RAM device or a separate device).

[0027] According to examples of this disclosure, data residing in a first RAM location can be accessed or read and can be moved to a memory location. In the examples, a second location is associated with a memory pool or set of memories. A memory pool can be equal to a percentage or portion of the total available memory used for storage. To enable data movement, system software, a memory controller, and / or DRAM logic can communicate to update a memory mapping that indicates the mapping between physical addresses provided by the processor and actual memory locations (e.g., tiers, groups, phases, rows, and columns). Because the location of the aggressor row may move, the likelihood of causing charge leakage (and thus row hammering attacks) is greatly reduced. That is, because the data is not in a fixed location for a certain period of time required to perform a row hammering attack or otherwise cause charge leakage, the electromagnetic interference between the (multiple) aggressor rows and (multiple) victim rows is insufficient to successfully execute a row hammering attack. In some examples, configuration settings can determine whether data should be moved and whether addresses should be remapped. That is, a portion of the overall memory or a portion of the memory associated with a process or user can be selectively protected from row hammering attacks and induced charge leakage.

[0028] According to examples of this disclosure, intruder rows can be identified, allowing data associated with those rows to be moved to another location. This disclosure introduces a probabilistic mechanism for identifying intruder rows. Specifically, each row can be associated with a small intruder probability p, such that each activation of the row triggers a potential intruder row determination. In some examples, potential intruder row determination can be based on probability p. This probability can be fixed across all rows or vary row-by-row depending on hardware usage and / or software state. For example, at activation time, a random number can be generated; if this random number is greater than a threshold (e.g., probability) for that particular row, the row can be identified as a potential intruder row and can be moved as described herein. In some examples, a counter-based identification process can be used to identify potential intruder rows; more specifically, a counter-based identification process can identify frequently accessed memory rows, also known as hot rows. If the number of activations exceeds a threshold, or the frequency of activation exceeds another threshold, the row can be identified as a potential intruder row, and the potential intruder row can be moved to a random access memory location. According to some examples, the identification of potential intruder rows can be performed on a per-row basis, or at predetermined times (e.g., rows accessed at a specific time can be identified as potential intruder rows). Accordingly, rows that are potential intruder rows can be moved to another location in memory. While aspects of this disclosure describe prevention of malicious attacks, such as row hammering attacks, the aspects disclosed herein can also be used to prevent induced charge leakage that may be caused by non-malicious use, such as induced charge leakage that may occur due to frequent access to hot rows.

[0029] Unlike existing row hammering mitigation techniques that commonly involve actively refreshing adjacent rows, the examples disclosed herein can reposition identified potential aggressor rows so that the electromagnetic interference caused by the potential aggressor row is insufficient to induce charge leakage and damage the intended victim row. In other words, moving rows identified as potential aggressor rows provides a more efficient solution than expending resources to identify the victim row as a targeted potential victim, as multiple potential aggressor rows can be identified using the counter-based identification process disclosed above. Furthermore, depending on the implementation, the identification and subsequent mitigation of potential aggressor rows can be performed by the memory controller and / or RAM device, by system software, by the memory controller, or by the RAM device as needed to manage data movement. That is, the movement of potential aggressor rows can be performed using only software, eliminating the need to modify the existing RAM hardware design to provide protection against row hammering attacks and / or induced charge leakage. In some examples, this data movement can also be used to reduce or eliminate side-channel attacks.

[0030] In some examples, data in a row can be moved directly by RAM logic. In some examples, the memory controller located between the processor and the RAM device can initiate data movement and maintain data mapping. However, in other cases, the operating system can move or otherwise copy data from RAM and update the corresponding entries in the page tables. In some examples, data movement and mapping operations can be based on whether a process utilizes a portion of memory and / or whether such configuration is enabled for an account. That is, a user may want to disable data movement operations for certain periods of time.

[0031] Figure 1 An example of a DRAM module 104 together with a central processing unit (CPU) 136 according to the present disclosure is depicted. The DRAM module 104 uses multiple cells to store information, wherein each DRAM cell stores information bits represented via capacitor 116. Figure 1 As shown, DRAM cells 112 are typically arranged in rows and columns to form a DRAM array 108. Each DRAM cell 112 may include a capacitor 116 for storing information bits and a transistor 120 for reading from and writing to the capacitor 116. Each DRAM cell 112 may be located or otherwise accessed via a row decoder 117 and a column decoder 124. That is, a CPU 136, including multiple cores 152 and multiple caches 156, 160, and 164, may access the DRAM cells 112 of the DRAM array 108 via a memory controller 134, wherein the memory controller may translate or otherwise map memory locations provided by the CPU 136 to one or more rows and columns in the DRAM array 108.

[0032] For example, CPU 136 can provide a "physical" address to memory controller 134; the physical address does not directly specify the address lines or rows and columns of DRAM array 108. Instead, the "physical address" provided by CPU 136 is mapped to the location of data stored in DRAM array 108. For example, it may be difficult to determine which DRAM module 104 and which DRAM cell 112 is referenced by physical address 0x004A4800. Therefore, when CPU 136 processes data from DRAM, memory controller 134 is responsible for fulfilling the request. Memory controller 134 obtains the physical address passed to it by CPU 136 and addresses the relevant location in DRAM module 104. As an example, CPU 136 can issue a load instruction to retrieve the word at the "physical address" of 0x004A4800. Memory controller 134 can then translate or map the "physical address" to a specific location in a specific DRAM module 104. The memory controller 134 can provide channel selection, level selection, group selection, row selection, and column selection information to the DRAM module 104 via one or more of the data lines 148 and 144. As an example, the memory controller can request a word from the DRAM module 104 for level 0, group 0, row 8192, and column 1019. Based on the information received from the memory controller, the row decoder 117 can, for example, provide current through the select line 122 of the DRAM cell 112, causing the transistor 120, which acts as a switch, to close, allowing charge stored in the capacitor 116 to flow to the data line 118. The sense amplifier 119 can detect and amplify the charge received on the data line 118, allowing the column decoder 124 to select the correct column based on the address information provided by the memory controller 134. Therefore, the column information can be provided to the buffer 126 and then back to the memory controller 134 via the bus 130. The memory controller 134 can then provide the "word" requested by the CPU 136 to the CPU 136 via the data bus 140.

[0033] Figure 2Additional details are depicted regarding reading the contents of a RAM array (e.g., DRAM array 204) according to an example of this disclosure. More specifically, CPU 220 can request information associated with a "physical address" as described above. Memory controller 216 can translate or otherwise map the "physical address" to a specific location in DRAM array 204. Thus, the DRAM device can activate a selected row, such as row 2, causing the contents of row 2 to be written to row buffer 208. However, in some cases, when reading a selected row (e.g., row 2), the capacitors in the selected row may discharge. Therefore, the DRAM device can issue a write-back command, causing the contents of row buffer 208 to be written back to the corresponding row, such as row 2. Multiple activations and write-backs may cause a normal row (e.g., row 2) to become an intruder row or a hot row.

[0034] Figure 3 Additional details are described regarding row hammering attacks, which are intentionally designed to cause induced charge leakage and bit flipping or otherwise damage the information stored in row 2. More specifically, row 2 in DRAM array 204 can be considered the victim row. Row 1 and / or rows 1 and 3 can be considered the aggressor rows and can be intentionally targeted at the victim row (e.g., row 2) to flip the bits in row 2. By repeatedly activating rows 1 and 3, for example, using a cycle with a specific activation pattern, one or more bits in row 2 can be flipped. That is, repeatedly activating rows 1 and 3 may cause capacitors in the memory cells of row 2 to discharge, causing previously stored charges representing logic high or "1" to now become logic low or "0". Figure 3 As shown, the capacitors associated with column 1 and row 2, and the capacitors associated with column 3 and row 2, toggle from logic high or "1" to logic low or "0", thereby corrupting the information stored in row 2. Examples of this disclosure can reduce and / or prevent data corruption in part due to induced charge leakage (e.g., via row hammering attacks or exploitation). For example, by identifying suspected intruder rows such as row 1 or row 3 and then moving the suspected intruder rows to different locations within the DRAM array 204, electromagnetic interference caused by rows 1 and 3 can be limited and / or reduced. Furthermore, data in rows 1 and / or row 3 can be moved to random locations within the DRAM array 204, making it more difficult to intentionally target the victim (row 2).

[0035] Figures 4A to 4CExamples of moving and / or remapping data according to this disclosure are depicted. That is, as described above, CPU 420 can request information associated with a "physical address." Memory controller 426 can translate or otherwise map the "physical address" to a specific location in RAM array 404. Therefore, a local RAM device located on the RAM chip can activate a selected row, such as row 2, causing the contents of row 2 to be written to row buffer 408. However, in some cases, when reading a selected row (e.g., row 2), the capacitors in the selected row may discharge, such as... Figure 4B As shown. Figure 4C As shown, if a row is identified as a suspected aggressor row based on an activation frequency determined, for example, by row activation counter 440, instead of having the RAM device issue a write-back command to write the contents of row buffer 408 back to the previous row (e.g., row 2), the RAM device can perform row hammer mitigation techniques by accessing the free memory pool table 436 to identify unused or free rows, such as row n0, and then writing the data in row buffer 408 to the identified unused row. In some cases, the previously accessed row (e.g., row 2) can then be added to the free memory pool. Thus, in the case where the potential aggressor row is row 2 and the victim rows(s) are rows 1 and 3, once moved, the potential aggressor row no longer affects the victim rows (e.g., rows 1 and / or row 3). In some examples, the RAM device can periodically move the contents of a row or memory location to another location based on a small aggressor probability p, such that each activation of the row will trigger an aggressor signal with probability p. In other words, instead of relying on row activation counter 440 to represent rows as potential aggressor rows, row activation can be triggered by row movement based on the probability associated with that row. For example, a random number can be generated or otherwise accessed when a row is activated; if the random number is greater than the probability associated with that row, the row can be identified as a potential aggressor row and can be moved as described herein. That is, the RAM device can move the contents of a potential aggressor row to a new row identified in the free memory pool table 436; in some examples, previously used rows are added to the free memory pool. Of course, when data is moved from one location to another, the RAM device can remap the data associated with the new location and notify the memory controller 426 of the location of the moved data, as shown in memory map 430.

[0036] Free memory pool table 436 can indicate which rows are free and can reside on or outside the RAM device. When the RAM device requests a free row, free memory pool table 436 can determine the free row in a random manner. Therefore, rows can be randomly allocated so that an adversary cannot target a specific victim row, as the aggressor will be far from the previously targeted victim row(s). Alternatively, the selection of free rows may not be random, but may be drawn from a queue or table in a specific order. Those skilled in the art will understand that any number of ways of selecting new rows can be employed without departing from the spirit of this disclosure. For example, data movement and remapping can occur according to configuration settings and can be applied only when the configuration is active, and / or can be applied only to specific memory locations. In some examples, the size of the free memory pool can be determined as a percentage or portion of the available storage provided by RAM module 104.

[0037] Alternatively or additionally, the memory controller 426 may be responsible for moving and / or remapping data contained in one or more identified locations. For example, the memory controller may use a free memory pool table 436 containing locations of free or otherwise unused memory in RAM module 104 to track available memory in the free memory pool. The memory controller 426 may then issue a move command to move data from its current location to a free location identified in the free memory pool table 436. The memory controller may then add the previous memory location to the free memory pool table 436 and update the memory mapping 430 that associates the new memory location with a physical address provided by the CPU. In some examples, the movement and remapping of data may occur based on configuration settings and may be applied only when the configuration is active, and / or may be applied only to specific memory locations. In some examples, the size of the free memory pool may be determined as a percentage or portion of the available storage provided by RAM module 104.

[0038] In some examples, the identification and / or movement of data by a potential aggressor can be performed by the operating system. For example, and according to examples in this disclosure, such as Figure 5The page table 504 shown can be a data structure used by the virtual memory system in a computer operating system to store the mapping between virtual addresses and physical addresses. In an operating system using virtual memory, processes are provided with what appear to be large, contiguous portions or pages of memory. Physically, each process's memory can be distributed across different areas of physical memory (e.g., RAM module 104). When a process requests access to data in its memory, the operating system is responsible for mapping the virtual address provided by the process to a physical address, allowing the memory controller to access the location of the stored data in RAM. The page table is where the operating system stores the mapping from virtual addresses to physical addresses; each mapping is also called a page table entry.

[0039] like Figure 5 As shown, page table 504 may include one or more page table entries 506A to 506D; each page table entry may contain a mapping from a virtual address or virtual page to a physical address or physical page 508 using one or more mappings 512. According to at least one example of this disclosure, a virtual address stored in page table entry 506B may be translated and mapped to page A 508A. At a random predetermined time, and / or when certain conditions are met or when a memory access is identified as a potential intruder, the operating system may move the contents of page A 508A to page D 508D. Therefore, page table entry 506B may then be updated to reflect the updated mapping to page D 508D. As an example, page A 508A may be identified as a potential intruder page based on multiple activations. In some examples, each page may be associated with a small intruder probability p, such that a generated random number greater than a threshold can be used to identify a particular page as a potential intruder page during a read or page access. In some examples, the probability threshold may be fixed across all pages or vary page-by-page. In the example, the identification of potential aggressor pages can be performed by software.

[0040] In some examples, available page 508 may be identified in free page pool 516. Free page pool 516 may include free pages available to the operating system, allowing the operating system to move data to one or more pages identified in the free page pool. Furthermore, once a page is no longer mapped to page table 504, such as page 508A, pages that are no longer in use may be added to free page pool 516.

[0041] Each page entry 506A through 506D is typically associated with a process, and the decision to remap page table entries to different pages can be based on configuration settings and an identifier that a page might be a potential attacker page. In cases where an application has been identified as a critical application or where the application's user wishes to protect the application from potential problems caused by line-hammering attacks, configuration settings allowing the operating system to remap page table entries to new blocks can indicate that such mapping is preferred. Therefore, the operating system can remap page table entries to a new table at random or predetermined times, or when specific conditions are met. The system can additionally employ various hardware and / or software optimizations to limit the number of remapping operations. These optimizations include, but are not limited to, cache line (pseudo) locking of data within an attacker page, and lazy remapping (i.e., remapping only the attacker page if it is subsequently accessed before the data is flushed).

[0042] Figure 6 A sample schematic diagram of a computing device 600 for mitigating induced charge leakage caused by hammer blows is shown. Figure 6 As shown, computing device 600 is illustrated as including a data movement and address remapping unit 632, a memory controller 604, a processing unit 612, and a RAM unit 620. In the example, computing device 600 is, for example, a desktop computing device, a server computing device, a laptop computing device, or a mobile computing device. In some cases, computing device 600 includes an advanced operating system (e.g., Microsoft Windows, Linux, Mac OS, etc.) and includes data movement and address remapping 632. For example, one or more system virtual address tables may be used by the operating system (and in some cases by a hypervisor). System virtual addresses can be translated into system physical addresses, which in turn can be translated into RAM logical addresses. Finally, logical addresses can be translated into internal addresses used by memory units. Therefore, in some examples, one or more such abstraction layers may be omitted. That is, in some examples, data movement and address remapping units 616 / 632 may reside in RAM logic 624 and / or memory controller 604.

[0043] Processing unit 612 executes instructions (e.g., data movement and address remapping unit 632) and communicates with RAM cell 620 via memory controller 604. In this example, memory controller 604 is part of processing unit 612. As described above, RAM cell 620 includes cells for storing bits. As an example, RAM cell 620 is a dual-input memory module (DIMM) consisting of capacitors for storing information bits. In other examples, RAM cell 620 is a sub-part of a memory module, such as a hierarchy or group. As described above, memory controller 604 can periodically send refresh commands to RAM cell 620.

[0044] According to the aspects described herein, the data movement and address remapping unit 632 can receive requests to move data from a page associated with a page table entry in the page table to a free page identified in the free memory pool to mitigate the effects of induced charge leakage. For example, an operating system executed by the computing device 600 can create a page table with one or more page table entries identifying memory pages in RAM unit 620 for use by one or more processes. At random or predetermined times, when specific conditions are met, and / or when generating and receiving intrusion signals, the operating system can move the contents of a page to another page identified in the free memory pool. The operating system can then associate the original page with the free memory pool. For example, to mitigate the potential effects of induced charge leakage, one or more pages can be randomly selected and moved to another page location. This selection of the page to be moved can occur according to a schedule or at random times. In some examples, the movement may occur when a location within the page is accessed.

[0045] Since each page table entry is typically associated with a process, the decision to remap page table entries to new pages can be based on configuration settings. For example, in cases where an application has been identified as a critical application or where the application's user wishes to protect the application from potential problems caused by line hammer attacks, configuration settings that allow the operating system to remap page table entries to new pages can indicate that such mapping is preferred. Therefore, the operating system can remap page table entries to new pages at random or predetermined times, or when specific conditions are met.

[0046] In some examples, computing device 600 may include memory controller 604, which includes data movement and address remapping unit 632 to move and / or remap data to mitigate the impact of potential row hammer attacks. For example, memory controller 604 may be responsible for moving and / or remapping data associated with a potential aggressor region to one or more identified locations. The memory controller may track a pool of free memory containing free locations in RAM cell 620 or other locations that are otherwise unused. Memory controller 604 may then issue a move command to move data from its current location to a free location identified in the free memory pool. RAM cell 620 may then add the previous location to the free memory pool and update the memory mapping that associates the new RAM location with a physical address provided by processing unit 612. In some examples, data movement and remapping may occur depending on configuration settings and may be applied only when the configuration is active, and / or may be applied only to specific memory locations.

[0047] In some examples, RAM cell 620 may include RAM-on-RAM logic 624, which includes a data movement and address remapping unit 628. As described above, the RAM-on-RAM logic allows the data movement and address remapping unit 628 to access a free memory pool to identify unused or free rows, into which data is moved to mitigate and / or eliminate the potential effects of row hammering. Therefore, the RAM-on-RAM can then write data into a row buffer and transfer the data to the identified unused row of RAM cell 620. In some cases, previously accessed rows may be added to the free memory pool. Alternatively or additionally, the RAM-on-RAM logic 624 may periodically move the contents of a row or location to another location based on a probability generated from a potential aggressor row indication. For example, each row may be associated with a small aggressor probability p, such that if the probability calculated at the time of row activation is greater than a probability threshold p, the row can be identified as or otherwise treated as a potential aggressor row. The probability may be fixed across all rows or vary row-by-row as hardware usage and / or software state change. Therefore, the logic 624 on RAM can move the contents of a row to a newly identified row in the free memory pool based on such a signal. In some examples, previously used rows are added to the free memory pool. Of course, when data is moved from one location to another, the logic 624 on RAM can remap the data associated with the new location and notify the memory controller 604 of the location of the moved data.

[0048] Figure 7 A schematic diagram of an example method 700 for moving data and remapping addresses, according to an example of this disclosure, is shown. In the example, aspects of method 700 are performed by a RAM device and / or a memory controller (e.g., logic 624 on RAM and / or memory controller 604). Method 700 begins at operation 701, in which a request for data associated with a first address is received. As an example, the memory controller may receive a read request from the CPU; in some aspects, the read request may originate from the memory controller. In some examples, the read request is for a word; in other examples, and where the read request originates from the memory controller, the read request may include columns and / or rows. At operation 702, data from the first address associated with the read request may be transferred to a row buffer.

[0049] In operation 703, and based on at least one of the aforementioned induced charge leakage detection techniques, read requests associated with a first address can be identified as potential intruder rows. In some examples, a performance counter associated with the first address can indicate that the number of read requests exceeds a threshold, or that the frequency of read requests exceeds a threshold. In some examples, the address or row associated with a read request can be identified as a potential intruder row. In some examples, the row associated with a read request can be identified as a hot row. As described above, intruder and potential intruder row determinations can be generated for each row activation or read and can be associated with the activation probability.

[0050] Upon determining that a row is a potential aggressor row or a hot row, the process can proceed to 706, where the RAM device and / or memory controller can identify a free RAM address from the free RAM address pool. For example, the RAM device and / or memory controller can request a free or available RAM pool. The free RAM pool can then randomly select a free RAM address from the free RAM address pool. As another example, the free DRAM pool can generate a random number and return an address associated with the random number. The address can correspond to a location in the RAM array. Method 700 then proceeds to operation 708, where data residing in the row buffer can be transferred to the identified RAM address received from the free RAM address pool. In some examples, the row buffer can be specific to a particular group of RAM. In the example, the free memory pool can be specific to a group of RAM, or it can span multiple groups of RAM. Therefore, if a free RAM address outside the RAM group accessible by the row buffer is selected, the row buffer can transfer data to the memory controller and / or RAM device, allowing the memory controller and / or RAM device to select the correct row buffer associated with the identified free RAM address. Method 700 can then proceed to operation 710, in which the identified free RAM address is removed from the free RAM pool. For example, the entry associated with the identified free RAM address can be deleted or otherwise removed. The process can then proceed to operation 712, in which the first RAM address can be added to the free RAM pool. By adding the first RAM address to the free RAM pool, the RAM pool can maintain sufficient RAM addresses for the purposes described herein.

[0051] In some examples, operations 706 to 712 may be based on configuration settings that indicate that a first address and / or the process associated with the first address will be protected from line hammer attacks and / or induced charge leakage that could corrupt data in the first address. Such configuration settings may be associated with identifiers indicating whether such addresses should be moved and remapped.

[0052] Although the operation of method 700 has been described in a specific order above, it should be understood that any of a variety of other orders can be used. For example, a free RAM address identified from the free RAM address pool can be identified before data is transferred from the first address to the row buffer. As another example, a identified free RAM address can be removed from the free RAM address pool before data in the row buffer is written to the identified free RAM address.

[0053] According to some examples of this disclosure, the identification of a first row as a potential aggressor row can be based on various conditions or probabilistic models. For example, a potential aggressor row can be identified when there is a cache miss and / or when the CPU requests data from the RAM array. In some examples, the identification of a potential aggressor row can be performed when a performance counter reaches a specific value, such as when the number or row activation exceeds a threshold or threshold frequency. In some examples, the identification of a potential aggressor row can depend on a random probability associated with each row, such that at least a threshold number of rows are moved over a period of time, or that a row will be probabilistically identified as a potential aggressor and then moved upon a specific number of activations. By randomly moving rows of data, the ability of (multiple) aggressor rows to target specific victim behaviors is significantly reduced, and the risk of induced charge leakage that may occur during legitimate use is also greatly reduced.

[0054] Figure 8 A schematic diagram of an example method 800 for moving data and remapping addresses according to an example of this disclosure is shown. In the example, aspects of method 800 are performed by a memory controller (e.g., memory controller 604). Method 800 begins at operation 802, where a data request is received at an address in RAM. At 804, it can be determined whether the address associated with the data request, and therefore the row, is a potential intruder row. As described above, a potential intruder row can be based on activation frequency and / or probability associated with DRAM access. In an example where the data request is not determined to be a potential intruder, method 800 can end at 816. Method 800 can then proceed to 805, where it is determined whether the identified address is identified as an address protected from row hammer attacks and / or induced charge leakage. For example, configuration settings can indicate that the address should be protected. As another example, configuration settings associated with the process can indicate that all addresses associated with the process will be protected from row hammer attacks and induced charge leakage. In an example where the configuration settings indicate that the identified address is not protected from row hammer attacks, method 800 can end at 816.

[0055] Method 800 can proceed to 806, where a RAM address from the free RAM address pool can be identified. For example, the memory controller can issue a request to the free RAM address pool. The free RAM address pool can then randomly select a free RAM address from the pool of free RAM addresses. As another example, the free RAM address pool can generate a random number and return the address associated with the random number. The address location can correspond to a location in the RAM array. Method 800 then proceeds to operation 808, where data stored in the address identified as a potential intruder row is moved to the identified free RAM address. For example, the memory controller can issue a move command to move data from the address identified as a potential intruder row to the identified free RAM address. Method 800 can then proceed to operation 810, where the identified free RAM address is removed from the free RAM address pool. The process can proceed to operation 812, where the address identified as a potential intruder is added to the free RAM address pool. By adding this address to the free RAM address pool, the RAM address pool can maintain sufficient memory locations for the purposes described herein.

[0056] Although the operation of method 800 has been described in a specific order above, it should be understood that any of a variety of other orders can be used. For example, a free RAM address identified from the free RAM address pool can be identified before that address is identified as a potential intruder. As another example, an identified free RAM address can be removed from the free RAM address pool before data is moved from an intruder address to the identified free RAM address. Method 800 may end at 816.

[0057] Figure 9A schematic diagram of an example method 900 for moving data and remapping memory blocks associated with pages in a page table, according to an example of this disclosure, is shown. In the example, aspects of method 900 are executed by processing unit 612 and operating system 608. In the example, memory controller 604 and logic 624 on RAM may be invoked, if necessary, to move data from one memory location to another. More specifically, method 900 may begin at operation 902, where a read request associated with a page is received. The flow may proceed to 904, where it may be determined whether the read request is associated with a potential intruder page. In the example, a potential intruder may be identified based on the number of memory reads associated with the page. In some examples, each page may be associated with a small intruder probability p, such that each page access or memory read associated with the page... In some examples, if a random number exceeding the probability threshold p is generated, the page may be considered an intruder page and may be moved as described herein. The probability may be fixed across all pages or vary page-by-page. In the example, the determination of whether a page is associated with a potential intruder may be performed in software.

[0058] In the example, page table entries in the page table may correspond to virtual addresses. In some cases, virtual addresses may be associated with processes and / or applications. Method 900 can then proceed to determine whether page table entries in the page table associated with the aggressor signal are identified as addresses protected against row hammer attacks and / or induced charge leakage. For example, configuration settings may indicate addresses or pages to be protected. As another example, configuration settings associated with a process may indicate that all addresses associated with page table entries in the page table should be protected against row hammer attacks and induced charge leakage. In an example where the data request is not associated with a potential aggressor, method 900 may end at 916.

[0059] Method 900 can proceed to 906, where a new page is requested from the free page pool. For example, the operating system may make a request to the free page pool. The free page pool may then randomly select a free page. As another example, the free page pool may generate a random number and return a free page associated with the random number. Method 900 then proceeds to operation 908, where the contents of the page associated with the aggressor signal are moved or otherwise stored in a new page. For example, the operating system may cause the memory controller to move the contents of one page to another. Method 900 may then proceed to operation 910, where page table entries are updated to reference the new page. The process may proceed to operation 912, where the new page is removed from the free page pool. In operation 914, the page associated with the aggressor signal may be added to the free page pool. By adding this page to the free page pool, the free page block pool can maintain sufficient available pages for the purposes described herein.

[0060] Although the operations of method 900 have been described in a specific order above, it should be understood that any of a variety of other orders can be used. For example, a new page can be identified from the free page pool before the page table entry associated with the aggressor page is identified in the page table. As another example, a new page can be removed from the free page pool before data is moved from the initial page to the new page.

[0061] According to some examples of this disclosure, a page can be identified as a potential aggressor page based on CPU events (such as, but not limited to, cache misses, page accesses, or performance counters associated with memory or data access within the page reaching a specific value). In some examples, the operating system can determine that a page can be identified as a potential aggressor page when it reads the contents of a cache line, such as when the operating system copies a page, or when the operating system copies another data unit to a new location. In some examples, the determination of whether a page is a potential aggressor page can be generated probabilistically, and can be generated when the probability associated with one or more of the events described above is greater than or equal to a threshold. It is understood that method 900 can be implemented entirely in software. Therefore, the need for hardware interaction can be avoided, except for storing and retrieving data, to prevent row hammer attacks and / or induced charge leakage.

[0062] Figure 10A An example user interface 1004, according to an example of this disclosure, is described for configuring line hammer protection as a service to monitor at least one of virtual machines, users, storage drives, threads, processes, or child processes. Although Figure 10A The document describes virtual machine identifiers, user identifiers, and process identifiers, but row hammer protection can be applied to other or additional parts of the computing system. For example, the granularity of row hammer protection can be defined based on one or more attributes used to identify or specify a region of RAM cell. These attributes can correspond to execution context identifiers, such as, but not limited to, machine identifiers, user identifiers, or process identifiers. As another example, in a multi-tenant setup, a tenant identifier can be used to protect one portion of RAM cells while excluding another.

[0063] As further depicted in user interface 1004, an identifier column 1008 and a row hammer protection status column 1012 can be displayed to the user. For identifier column 1008, the user can configure a specific identifier associated with row hammer protection. For example, dropdown list 1024 can allow the user to configure row hammer protection via process_ID 1028 and then specify a process (such as process_ID_EXE) for protection. Of course, other identifiers and / or configurations are also possible. For example, storage drive, thread identifier, and / or child process identifier can be further configured to prevent leakage caused by row hammers and / or other charges. Furthermore, and as described above, the status of row hammer protection can be displayed to the user in the row hammer protection status bar 1012. For example, the row hammer protection status can be displayed as enabled or disabled. In some examples, the user can interact with the row hammer protection status bar 1012 to selectively enable or disable row hammer protection.

[0064] In some examples, user interface 1004 may provide the user with notifications that a memory address or computer system may benefit from line hammer mitigation as described herein. For example, a pop-up window may be provided to the user, and / or events in the event log may indicate potential line hammer attacks and / or leakage events caused by other charges.

[0065] Figure 10B Data structure 1032, according to an example of this disclosure, is depicted for indicating whether identifier 1036 is associated with a protected memory space or a portion of a RAM array. For example, identifier 1036 may indicate that an address space, user, process, virtual machine identifier, or application may be associated with a protected memory space or protected portion of a RAM array. For example, a protected portion may be a portion of the RAM array protected against row hammer attacks and / or induced charge leakage as described herein. Identifier 1036 may be an execution context identifier, such as an identifier associated with or otherwise corresponding to a user identifier; thus, all memory (e.g., RAM) accessed or used by a user associated with the user identifier may be protected against row hammer attacks and / or induced charge leakage. Protected memory space identifier 1040 indicates whether identifier 1036 is associated with a protected memory space. Therefore, different portions of memory or different portions of the RAM array, different users, and / or different processes may be configured with protected memory spaces and thus protected against row hammer attacks as described herein.

[0066] Figure 11A block diagram depicts a multitenant configuration according to at least one example of this disclosure. For example, hypervisor 1104 can access memory space 1, memory space 2, and memory space 3. One or more virtual machines, such as virtual machine 1 1120, virtual machine 2 1116, and virtual machine 3 1112, may be provided by hypervisor 1104. In some examples, a portion 1108 of the memory space may be shared by each of the virtual machines 1 1120, 2 1116, and / or 3 1112. To prevent possible row hammer attacks and / or data corruption caused by induced charge leakage, the portion 1108 of the memory space can be protected according to the memory protection methods described herein. Therefore, a malicious actor (such as virtual machine 11120) cannot corrupt the data in the portion 1108 of the memory space.

[0067] Figures 12 to 15 The related descriptions provide a discussion of various operating environments in which the aspects of this disclosure can be practiced. However, regarding Figures 12 to 15 The devices and systems shown and discussed are for illustrative purposes only and are not intended to limit the wide range of computing device configurations that can be used to practice the aspects of this disclosure described herein.

[0068] Figure 12 This is a block diagram illustrating the physical components (e.g., hardware) of a computing device 1200 that can be used to practice various aspects of this disclosure. The computing device components described below are applicable to the aforementioned computing device, including... Figure 6 The computing device 600 is described above. In a basic configuration, the computing device 1200 may include at least one processing unit 1202 and system memory 1204, wherein the system memory 1202 may be DRAM. Depending on the configuration and type of the computing device, the system memory 1204 may include, but is not limited to, volatile memory (e.g., random access memory (RAM)), non-volatile memory (e.g., read-only memory (ROM)), flash memory, or any combination of these memories.

[0069] System memory 1204 may include an operating system 1205 and one or more program modules 1206 suitable for running software applications 1220, such as one or more components supported by the system described herein. As an example, system memory 1204 may store data movement and address mappers 1224. For instance, operating system 1205 may be adapted to control the operation of computing device 1200.

[0070] Furthermore, embodiments of this disclosure can be practiced in conjunction with graphics libraries, other operating systems, or any other applications, and are not limited to any particular application or system. This basic configuration is... Figure 12The components within the dashed lines 1208 are shown. The computing device 1200 may have additional features or functions. For example, the computing device 1200 may also include additional (removable and / or non-removable) data storage devices, such as disks, optical discs, or magnetic tapes. This additional storage... Figure 12 The image is shown by removable storage device 1209 and non-removable storage device 1210.

[0071] As described above, multiple program modules and data files can be stored in system memory 1204. When executed on processing unit 1202, program module 1206 (e.g., application 1220) can perform processes including, but not limited to, the aspects described herein. Other program modules that can be used according to aspects of this disclosure may include email and contact applications, word processing applications, spreadsheet applications, database applications, PowerPoint presentation applications, drawing or computer-aided applications, etc.

[0072] Furthermore, embodiments of this disclosure can be practiced in circuits including discrete electronic components, in packages or integrated electronic chips containing logic gates, in circuits utilizing microprocessors, or on a single chip containing electronic components or a microprocessor. For example, embodiments of this disclosure can be practiced via a system-on-a-chip (SoC), wherein... Figure 12 Each or more components shown can be integrated onto a single integrated circuit. Such a SoC device may include one or more processing units, graphics units, communication units, system virtualization units, and various application functions, all integrated (or “burned in”) onto a chip substrate as a single integrated circuit. When operating via the SoC, the functionality described herein regarding the ability to switch client protocols can be operated via application-specific logic integrated with other components of the computing device 1200 on the single integrated circuit (chip). Embodiments of this disclosure can also be practiced using other techniques capable of performing logical operations (e.g., AND, OR, and NOT), including but not limited to mechanical, optical, fluid, and quantum technologies. Furthermore, embodiments of this disclosure can be practiced within a general-purpose computer or in any other circuit or system.

[0073] The computing device 1200 may also have one or more input devices 1212, such as a keyboard, mouse, pen, voice or speech input device, touch or swipe input device, etc. It may also include output devices(s) 1214, such as a monitor, speaker, printer, etc. The above devices are examples, and other devices may be used. The computing device 1200 may include one or more communication connections 1216 that allow communication with other computing devices 1250. Examples of suitable communication connections 1216 include, but are not limited to, radio frequency (RF) transmitters, receivers, and / or transceiver circuitry; universal serial buses (USB), parallel and / or serial ports.

[0074] The term "computer-readable medium" as used herein can include computer storage media. Computer storage media can include volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable instructions, data structures, or program modules. System memory 1204, removable storage device 1209, and non-removable storage device 1210 are examples of computer storage media (e.g., memory storage). Computer storage media can include RAM, ROM, electrically erasable read-only memory (EEPROM), flash memory or other storage technologies, CD-ROM, digital versatile disc (DVD) or other optical storage, cassette tape, magnetic tape, disk storage or other magnetic storage devices, or any other article of manufacture that can be used to store information and can be accessed by computing device 1200. Any such computer storage medium can be part of computing device 1200. Computer storage media does not include carrier waves or other propagated or modulated data signals.

[0075] Communication media can be implemented from computer-readable instructions, data structures, program modules, or other data in modulated data signals (such as carrier waves or other transmission mechanisms), and include any information transmission medium. The term "modulated data signal" can describe a signal having one or more characteristics that are set or altered in a manner that encodes information in the signal. As an example, and not a limitation, communication media can include wired media such as wired networks or direct wired connections, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.

[0076] Figures 13A to 13B A mobile computing device 1300, which can be used to practice embodiments of the present disclosure, is shown, such as a mobile phone, smartphone, wearable computer (e.g., a smartwatch), tablet computer, laptop computer, etc. In some aspects, the client may be a mobile computing device. References Figure 13A This illustrates one aspect of a mobile computing device 1300 used to implement these aspects. In a basic configuration, the mobile computing device 1300 is a handheld computer with both input and output elements. The mobile computing device 1300 typically includes a display 1305 and one or more input buttons 1310 that allow the user to input information into the mobile computing device 1300. The display 1305 of the mobile computing device 1300 can also be used as an input device (e.g., a touchscreen display).

[0077] If included, the optional side input element 1315 allows for further user input. The side input element 1315 can be a rotary switch, a button, or any other type of manual input element. Alternatively, the mobile computing device 1300 may include more or fewer input elements. For example, in some embodiments, the display 1305 may not be a touchscreen.

[0078] In another alternative embodiment, the mobile computing device 1300 is a portable telephone system, such as a cellular phone. The mobile computing device 1300 may also include an optional keyboard 1335. The optional keyboard 1335 may be a physical keyboard or a "soft" keyboard generated on a touchscreen display.

[0079] In various embodiments, output elements include a display 1305 for displaying a graphical user interface (GUI), a visual indicator 1320 (e.g., a light-emitting diode), and / or an audio transducer 1325 (e.g., a speaker) for displaying a graphical user interface (GUI). In some aspects, the mobile computing device 1300 includes a vibration transducer for providing haptic feedback to a user. In another aspect, the mobile computing device 1300 includes input and / or output ports, such as audio input (e.g., a microphone jack), audio output (e.g., a headphone jack), and video output (e.g., an HDMI port), for sending signals to or receiving signals from external devices.

[0080] Figure 13B This is a block diagram illustrating the architecture of one aspect of a mobile computing device. That is, the mobile computing device 1300 may include a system (e.g., architecture) 1302 to implement some aspects. In one embodiment, the system 1302 is implemented as a "smartphone" capable of running one or more applications (e.g., browser, email, calendar, contact manager, messaging client, game, and media client / player). In some aspects, the system 1302 is integrated as a computing device, such as integrating a personal digital assistant (PDA) and a wireless phone.

[0081] One or more applications 1366 may be loaded into memory 1362 and run on or associated with operating system 1364. Examples of applications include telephone dialers, email programs, personal information management (PIM) programs, word processing programs, spreadsheet programs, internet browser programs, messaging programs, and so on. System 1302 also includes a non-volatile storage area 1368 within memory 1362. The non-volatile storage area 1368 may be used to store persistent information that should not be lost when system 1302 is powered off. Applications 1366 may use and store information, such as emails or other messages used by email applications, in the non-volatile storage area 1368. Synchronization applications (not shown) also reside on system 1302 and are programmed to interact with corresponding synchronization applications residing on the host computer to keep the information stored in the non-volatile storage area 1368 synchronized with the corresponding information stored on the host computer. It should be understood that other applications can be loaded into memory 1362 and run on the mobile computing device 1300 described herein (e.g., search engine, extractor module, relevance ranking module, answer scoring module, etc.).

[0082] System 1302 has a power supply 1370, which can be implemented as one or more batteries. The power supply 1370 may also include an external power source, such as an AC adapter or a charging dock for replenishing or recharging the batteries.

[0083] System 1302 may also include a radio interface layer 1372, which performs the functions of transmitting and receiving radio frequency communications. Radio interface layer 1372 facilitates wireless connectivity between system 1302 and the "external world" via a communications operator or service provider. Transmissions to and from radio interface layer 1372 are performed under the control of operating system 1364. In other words, communications received by radio interface layer 1372 can be propagated to application 1366 via operating system 1364, and vice versa.

[0084] A visual indicator 1320 can be used to provide visual notifications, and / or an audio interface 1374 can be used to generate audible notifications via an audio transducer 1325. In the illustrated embodiment, the visual indicator 1320 is a light-emitting diode (LED), and the audio transducer 1325 is a speaker. These devices can be directly coupled to a power supply 1370 such that when activated, they remain on for a duration specified by the notification mechanism, even if the processor 1360 and other components may be turned off to conserve battery power. The LED can be programmed to remain on indefinitely until the user takes action to indicate the device's power-on state. The audio interface 1374 is used to provide and receive audible signals to and from the user. For example, in addition to being coupled to the audio transducer 1325, the audio interface 1374 can also be coupled to a microphone to receive audio input, such as for telephone conversations. According to embodiments of this disclosure, the microphone can also be used as an audio sensor to control notifications, as will be described below. System 1302 may also include a video interface 1376, which enables the operation of the airborne camera 1330 to record still images, video streams, etc.

[0085] The mobile computing device 1300 implementing system 1302 may have additional features or functions. For example, the mobile computing device 1300 may also include additional (removable and / or non-removable) data storage devices, such as disks, optical discs, or magnetic tapes. This additional storage... Figure 13B The non-volatile storage region 1368 is shown in the middle.

[0086] Data / information generated or captured by mobile computing device 1300 and stored via system 1302 can be stored locally on mobile computing device 130 as described above, or the data can be stored on any number of storage media that can be accessed by the device via radio interface layer 1372 or via a wired connection between mobile computing device 1300 and a separate computing device associated with mobile computing device 1300 (e.g., a server computer in a distributed computing network such as the Internet). It should be understood that such data / information can be accessed via mobile computing device 1300 via radio interface layer 1372 or via a distributed computing network. Similarly, according to known data / information transmission and storage devices (including email and collaborative data / information sharing systems), such data / information can be easily transferred between computing devices for storage and use.

[0087] Figure 14One aspect of a system architecture for processing data received at a computing system from a remote source, such as a personal computer 1404, a tablet computing device 1406, or a mobile computing device 1408 as described above. Content displayed at server device 1402 can be stored in different communication channels or other storage types. For example, various documents can be stored using a directory service 1422, a portal website 1424, an email service 1426, an instant messaging storage 1428, or a social networking site 1430.

[0088] The data movement and address remapping unit 1421 can be used by a client communicating with server device 1402, and can also be used by server device 1402. Server device 1402 can provide data to and from client computing devices via network 1415, such as personal computer 1404, tablet computing device 1406, and / or mobile computing device 1408 (e.g., smartphone). As an example, the above-described computer system can be implemented in personal computer 1404, tablet computing device 1406, and / or mobile computing device 1408 (e.g., smartphone). Any of these embodiments of the computing device can retrieve content from storage 1416, and can also receive graphics data that can be preprocessed at a graphics generation system or post-processed at a receiving computing system.

[0089] Figure 15 An exemplary tablet computing device 1500 is shown that can perform one or more aspects of the present invention. Furthermore, the aspects and functions described herein can operate on a distributed system (e.g., a cloud-based computing system), wherein application functions, memory, data storage and retrieval, and various processing functions can operate remotely to each other on a distributed computing network such as the Internet or an intranet. Various types of user interfaces and information can be displayed via an onboard computing device display or via a remote display unit associated with one or more computing devices. For example, various types of user interfaces and information can be displayed and interacted with on a wall surface, where various types of user interfaces and information can be projected. Interaction with multiple computing systems that can be used to practice embodiments of the invention includes keystroke input, touchscreen input, voice or other audio input, gesture input, wherein the associated computing device is equipped with detection (e.g., camera) functions for capturing and interpreting user gestures to control the functions of the computing device, and so on.

[0090] For example, aspects of this disclosure have been described above with reference to block diagrams and / or operational illustrations of methods, systems, and computer program products according to aspects of this disclosure. As shown in any flowchart, the functions / actions shown in the blocks may appear in inconsistent order. For example, depending on the functions / actions involved, two blocks shown consecutively may actually be executed substantially simultaneously, or these blocks may sometimes be executed in reverse order.

[0091] The descriptions and illustrations of one or more aspects provided in this application are not intended to limit or restrict the scope of this disclosure in any way. The aspects, examples, and details provided in this application are considered sufficient to convey ownership and enable others to make and use the best mode of the claimed disclosure. The claimed disclosure should not be construed as limited to any aspect, example, or detail provided in this application. Various features (structural and methodological features) are intended to be selectively included or omitted, whether shown and described in combination or separately, to produce embodiments with a particular set of features. Given the descriptions and illustrations provided in this application, variations, modifications, and alternatives falling within the spirit of the broader aspects of the general inventive concept embodied in this application will occur to those skilled in the art, without departing from the broader scope of the claimed disclosure.

Claims

1. A method for preventing access pattern attacks in random access memory (RAM), the method comprising: Identify data requests associated with the operating system's page tables as security risks; as well as The security risk is mitigated by performing operations including an execution context identifier that indicates that memory associated with at least one of a multitenant installation-specific user identifier or a multitenant installation-specific tenant identifier is protected against access pattern attacks. Select a memory region from the subset of memory regions as the first memory region; Data stored in a second memory area associated with a page table entry of the page table is copied to the first memory area; Deassociate the first memory region with the subset of memory regions, and associate the second memory region with the subset of memory regions; as well as Update the page table entry in the page table to reference the first memory region.

2. The method according to claim 1, further comprising: Select another memory region from the subset of memory regions as the third memory region; The data stored in the first memory area is copied to the third memory area; Deassociate the third memory region with the subset of memory regions, and associate the first memory region with the subset of memory regions; as well as Update the page table entries to reference the third memory region.

3. The method according to claim 1, further comprising: Based on the model selected according to configuration settings, data requests are periodically identified as potential security risks.

4. The method of claim 3, wherein the configuration settings are specific to at least one execution context identifier.

5. The method of claim 1, wherein the virtual address of the page table entry is remapped to a new physical address associated with a third memory region.

6. The method according to claim 1, further comprising: Provide the first tenant of the multi-tenant installation with access to the memory group; as well as Access to the memory group is provided to a second tenant of the multi-tenant installation, wherein data associated with the page table of the first tenant is moved to another memory region within the memory group.

7. The method of claim 1, wherein identifying the data request associated with the page table as a security risk occurs based on at least one of the following: a cache miss in the central processing unit, a page counter exceeding a threshold, or a page access frequency exceeding a threshold.

8. The method of claim 1, wherein identifying the data request as a security risk includes: Generate random numbers; as well as The generated random number is determined to be greater than a threshold, wherein the threshold is the intruder probability of a page in a page table specific to the operating system.

9. The method according to claim 1, further comprising: Provide the user with an indication that at least one of the security risks has been detected or is being mitigated.

10. A method for preventing access pattern attacks in a random access memory (RAM) array, the method comprising: Data requests associated with random access memory (RAM) arrays are identified as potential security risks; as well as The security risk is mitigated by performing operations including the following, based on an execution context identifier that indicates that memory associated with at least one of a user identifier or a tenant identifier is protected against access pattern attacks: Select the first row in the RAM array, the first row storing the requested data; The data is received in the row buffer; Select the second row from the row set; Associate the second row with the set of rows; The data located in the row buffer is stored in the second row; as well as Associate the first row with the set of rows.

11. The method of claim 10, further comprising: The first row is activated to receive the data stored in the selected row in the row buffer, wherein the row buffer is a row buffer for a memory group.

12. The method of claim 11, further comprising: The data located in the row buffer is stored in the second row when at least one of the following occurs: a cache miss, an activation counter associated with the first row exceeds a threshold, or an access frequency associated with the first row exceeds a threshold.

13. The method of claim 10, wherein identifying the data request associated with the random access memory (RAM) array as a security risk is based on the probability associated with the first row exceeding a probability threshold.

14. The method of claim 10, further comprising: Receive the data stored in the second row of the row buffer; Select the third row from the set of rows; Associate the third row with the solution of the row set; The data received from the second row and located in the row buffer is stored in the third row; as well as Associate the second row with the set of rows.

15. The method of claim 10, wherein identifying the data request as a security risk includes: Generate random numbers as a probability threshold; as well as The probability threshold is determined to be greater than the aggressor probability specific to the first row.

16. A method for preventing access pattern attacks in random access memory (RAM), the method comprising: Data requests associated with pages in the operating system's page tables are identified as security risks; as well as The security risk is mitigated by performing operations including an execution context identifier that indicates that memory associated with at least one of a multitenant installation-specific user identifier or a multitenant installation-specific tenant identifier is protected against access pattern attacks. Obtain the first location identifier of the page identified as the security risk; Retrieve the second location identifier of the available page associated with the free page pool; Move the content from the page identified as a security risk to the available page; Update the entry in the page table associated with the first location identifier to reference the second location identifier; and Associate the first location identifier with the free page pool.

17. The method of claim 16, further comprising: Provide the first tenant of the multi-tenant installation with access to the memory group; as well as Access to the memory group is provided to a second tenant of the multi-tenant installation, wherein data associated with the page table of the first tenant is moved to another memory region within the memory group.

18. The method of claim 16, wherein identifying the data request associated with the page table as a security risk occurs based on at least one of the following: a cache miss in the central processing unit, a page counter exceeding a threshold, or a page access frequency exceeding a threshold.

19. The method of claim 16, further comprising: Data requests are periodically identified as potential security risks based on a model selected based on configuration settings, wherein the configuration settings are specific to at least one execution context identifier.

20. The method of claim 16, wherein identifying the data request as a security risk includes: Generate random numbers; as well as The generated random number is determined to be greater than a threshold, wherein the threshold is the intruder probability of the page in the page table specific to the operating system.

Images