iMIV: in-Memory Integrity Verification for NVM

TL;DR

The paper introduces iMIV, a low-overhead in-memory integrity verification method for NVM that significantly reduces performance overheads by performing security operations close to the memory.

Contribution

iMIV presents a novel in-memory integrity verification approach that minimizes off-chip data movement and overheads for NVM security.

Findings

Reduces performance overhead from 205% to 55%.

Employs in-memory computing for security operations.

Designed based on typical NVDIMM architectures.

Abstract

Non-volatile Memory (NVM) could bridge the gap between memory and storage. However, NVMs are susceptible to data remanence attacks. Thus, multiple security metadata must persist along with the data to protect the confidentiality and integrity of NVM-resident data. Persisting Bonsai Merkel Tree (BMT) nodes, critical for data integrity, can add significant overheads due to need to write large amounts of metadata off-chip to the bandwidth-constrained NVMs. We propose iMIV for low-overhead, fine-grained integrity verification through in-memory computing. We argue that memory-intensive integrity verification operations (BMT updates and verification) should be employed close to the NVM to limit off-chip data movement. We design iMIV based on typical NVDIMM designs that have an onboard logic chip with a trusted encryption engine, separate from the untrusted storage media. iMIV reduces the performance overheads from 205% to 55% when integrity verification operations are offloaded to NVM compared to when all the security operations are employed at the memory controller.