Probabilistic Tracker Management Policies for Low-Cost and Scalable Rowhammer Mitigation

Aamer Jaleel,Stephen W. Keckler,Gururaj Saileshwar

2024-04-25

Abstract:This paper focuses on mitigating DRAM Rowhammer attacks. In recent years, solutions like TRR have been deployed in DDR4 DRAM to track aggressor rows and then issue a mitigative action by refreshing neighboring victim rows. Unfortunately, such in-DRAM solutions are resource-constrained (only able to provision few tens of counters to track aggressor rows) and are prone to thrashing based attacks, that have been used to fool them. Secure alternatives for in-DRAM trackers require tens of thousands of counters.

Cryptography and Security,Hardware Architecture

What problem does this paper attempt to address?

### What problem does this paper attempt to solve?

This paper aims to solve the Rowhammer attack problem in DRAM (Dynamic Random - Access Memory). Specifically, it focuses on how to effectively mitigate Rowhammer attacks in resource - constrained environments, especially when the Rowhammer threshold (TRH) drops below 1,000.

#### Background of Rowhammer Attacks

Rowhammer attacks cause charge leakage and bit flips in adjacent rows (called "victim rows") by rapidly activating a certain row in DRAM (called "aggressor row"). This kind of attack not only affects the reliability of memory but can also be exploited for security vulnerability attacks, such as obtaining kernel - level privileges or leaking sensitive data through bit flips.

#### Limitations of Existing Solutions

1. **Resource - Constrained Trackers**: Existing DRAM - built - in mitigation schemes (such as Targeted Row Refresh, TRR) can only provide a small number of counters (usually only a few dozen per DRAM bank) due to resource limitations. These trackers are vulnerable to thrashing - based attacks because attackers can evict entries in the tracker by activating a large number of rows, thus bypassing mitigation measures.

2. **High - Overhead Trackers**: To prevent thrashing attacks, some emerging trackers use deterministic tracking algorithms and require thousands of counters. However, these high - overhead trackers are difficult to implement in practical applications because they require a large amount of storage space and complex hardware design.

#### The Method Proposed in the Paper

To solve the above problems, the paper proposes PRObabilistic TrackE r mA nagement policieS (PROTEAS), a probabilistic tracker management strategy. PROTEAS can resist thrashing attacks and remain efficient and secure in resource - constrained situations by introducing non - deterministic insertion and eviction strategies.

#### Key Ideas of PROTEAS

1. **Probability Sampling**: PROTEAS uses two sampling methods:
- **Probabilistic Request Stream Sampling (PRSS)**: Only look up part of the request stream, and directly skip the rest of the requests. This can reduce the number of insertions into the tracker and prevent the tracker from being filled by thrashing attacks.
- **Probabilistic Miss Stream Sampling (PMSS)**: Only insert into part of the missing streams, and directly skip the rest of the missing streams. This method is less effective than PRSS because it can still cause the tracker to be filled by thrashing attacks.

2. **Random Replacement**: PROTEAS adopts a random replacement strategy to ensure that diverse rows are retained in the tracker, rather than always evicting the least - used entries. This increases the difficulty for attackers to predict and exploit the behavior of the tracker.

#### Experimental Results

The paper verifies the effectiveness of PROTEAS through experiments. The results show that PROTEAS can limit the maximum number of interferences to within 2.1K with only 16 counters per DRAM bank, far below the existing Rowhammer thresholds of DDR4 and LPDDR4 (4.9K to 9K). In addition, when PROTEAS is used in combination with the new feature RFM of DDR5, the maximum number of interferences can be further reduced, making it a scalable defense solution when the Rowhammer threshold drops to 1K or lower in the future.

### Summary

By introducing a probabilistic tracker management strategy, this paper solves the problem that existing resource - constrained trackers are vulnerable to thrashing attacks while maintaining low performance and storage overhead. This method provides an effective Rowhammer attack mitigation solution for future DRAM designs.