Memory Row Access Cardinality Estimation for Rowhammer Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory access systems struggle to detect rowhammer attacks effectively due to high storage and processing requirements, and existing methods like sliding windows are ineffective in identifying frequent accesses over a short period.
Innovation Solution
The implementation of estimation circuitry to calculate a statistical cardinality count of memory row addresses with an exponential time-based decay, which adjusts the weight of access frequency over time, combined with restriction circuitry to limit access requests and reduce the likelihood of bit flips.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If exact counting of memory row accesses is implemented, then detection precision improves, but storage requirements increase prohibitively
Solution Approach 1:
The patent uses probabilistic data structures (hyperloglog, bloom filters) that provide approximate counting with minimal storage overhead. These structures sacrifice exactness for extreme space efficiency, allowing monitoring of memory access patterns without requiring prohibitive storage resources. The approximation error is acceptable for security monitoring purposes where detecting suspicious patterns is more important than exact counts.
Solution Approach 2:
The patent creates virtual copies of memory access metadata in software rather than maintaining exact physical counts. The virtual memory layer maintains access patterns in software data structures that consume minimal space, avoiding the need for extensive hardware storage while still enabling detection of rowhammer attacks through pattern analysis.
2Loss of time
If sliding window technique is used to track access frequency, then time-based detection improves, but storage and processing requirements increase significantly
Solution Approach 1:
The patent extracts only the essential time-based pattern information needed for rowhammer detection without maintaining complete access logs. By using probabilistic structures that summarize access patterns rather than storing individual access events, the system achieves time-based detection capability with minimal storage and processing overhead.
Solution Approach 2:
The patent implements dynamic adjustment of monitoring parameters based on observed access patterns. The system adapts its detection sensitivity and window sizes based on workload characteristics, allowing effective rowhammer detection while optimizing resource usage according to actual system conditions rather than using fixed conservative parameters.
3Reliability
If comprehensive monitoring of all memory accesses is implemented, then detection capability improves, but processing overhead increases
Solution Approach 1:
The patent implements partial monitoring by focusing computational resources on detecting specific suspicious patterns rather than analyzing every memory access in detail. The system uses lightweight probabilistic data structures that require minimal processing per access event, enabling comprehensive monitoring at scale with acceptable overhead by processing only the essential features of access patterns.
Data Source
AI summary
There is provided a data processing apparatus comprising: memory access circuitry configured to issue access requests to a memory system: estimation circuitry configured to estimate a statistical cardinality count on memory row addresses accessed by the access requests: and decay circuitry configured to apply an exponential time-based decay during estimation of the statistical cardinality count.