Scalable and Secure Row-Swap: Efficient and Safe Row Hammer Mitigation in Memory Systems

TL;DR

This paper introduces a new scalable and secure row-swap defense mechanism for DRAM that effectively mitigates Row Hammer attacks, including advanced patterns like Juggernaut, with low overhead and improved security.

Contribution

It proposes the Secure Row-Swap method with attack detection, overcoming vulnerabilities of prior RRS and enabling scalable, long-term Row Hammer protection.

Findings

Juggernaut attack breaks RRS in under 1 day.

Secure Row-Swap prevents Juggernaut and reduces swap frequency.

The proposed mechanism offers 3.3X lower overhead with minimal slowdown.

Abstract

As Dynamic Random Access Memories (DRAM) scale, they are becoming increasingly susceptible to Row Hammer. By rapidly activating rows of DRAM cells (aggressor rows), attackers can exploit inter-cell interference through Row Hammer to flip bits in neighboring rows (victim rows). A recent work, called Randomized Row-Swap (RRS), proposed proactively swapping aggressor rows with randomly selected rows before an aggressor row can cause Row Hammer. Our paper observes that RRS is neither secure nor scalable. We first propose the `Juggernaut attack pattern' that breaks RRS in under 1 day. Juggernaut exploits the fact that the mitigative action of RRS, a swap operation, can itself induce additional target row activations, defeating such a defense. Second, this paper proposes a new defense Secure Row-Swap mechanism that avoids the additional activations from swap (and unswap) operations and protects against Juggernaut. Furthermore, this paper extends Secure Row-Swap with attack detection to defend against even future attacks. While this provides better security, it also allows for securely reducing the frequency of swaps, thereby enabling Scalable and Secure Row-Swap. The Scalable and Secure Row-Swap mechanism provides years of Row Hammer protection with 3.3X lower storage overheads as compared to the RRS design. It incurs only a 0.7% slowdown as compared to a not-secure baseline for a Row Hammer threshold of 1200.