SoK: Systematizing a Decade of Architectural RowHammer Defenses Through the Lens of Streaming Algorithms

TL;DR

This paper systematically reviews a decade of architectural RowHammer defenses using streaming algorithms, providing a taxonomy, practical guides, and proposing new algorithms to enhance security and efficiency.

Contribution

It introduces a comprehensive taxonomy of 48 defenses, maps them to streaming algorithms, and offers practical guides and new algorithms like StickySampling for improved security.

Findings

Mapped multiple defenses to streaming algorithms

Provided practical guides for defense selection

Proposed new algorithms like StickySampling

Abstract

A decade after its academic introduction, RowHammer (RH) remains a moving target that continues to challenge both the industry and academia. With its potential to serve as a critical attack vector, the ever-decreasing RH threshold now threatens DRAM process technology scaling, with a superlinearly increasing cost of RH protection solutions. Due to their generality and relatively lower performance costs, architectural RH solutions are the first line of defense against RH. However, the field is fragmented with varying views of the problem, terminologies, and even threat models. In this paper, we systematize architectural RH defenses from the last decade through the lens of streaming algorithms. We provide a taxonomy that encompasses 48 different works. We map multiple architectural RH defenses to the classical streaming algorithms, which extends to multiple proposals that did not identify this link. We also provide two practitioner guides. The first guide analyzes which algorithm best fits a given RHTH, location, process technology, storage type, and mitigative action. The second guide encourages future research to consult existing algorithms when architecting RH defenses. We illustrate this by demonstrating how Reservoir-Sampling can improve related RH defenses, and also introduce StickySampling that can provide mathematical security that related studies do not guarantee.