The DRAM Latency PUF:

Size: px

Start display at page:

Download "The DRAM Latency PUF:"

Charles Nash
5 years ago
Views:

1 The DRAM Latency PUF: Quickly Evaluating Physical Unclonable Functions by Exploiting the Latency-Reliability Tradeoff in Modern Commodity DRAM Devices Jeremie S. Kim Minesh Patel Hasan Hassan Onur Mutlu

2 Executive Summary Motivation: We can authenticate a system via unique signatures if we can evaluate a Physical Unclonable Function (PUF) on it Signatures (PUF response) reflect inherent properties of a device DRAM is a promising substrate for PUFs because it is widely used Problem: Current DRAM PUFs are 1) very slow, 2) require a DRAM reboot, or 3) require additional custom hardware Goal: To develop a novel and effective PUF for existing commodity DRAM devices with low-latency evaluation time and low system interference across all operating temperatures DRAM Latency PUF: Reduce DRAM access latency below reliable values and exploit the resulting error patterns as unique identifiers Evaluation: 1. Experimentally characterize 223 real LPDDR4 DRAM devices 2. DRAM latency PUF (88.2 ms) achieves a speedup of 102x/860x at 70 C/55 C over prior DRAM PUF evaluation mechanisms 2/45

3 The DRAM Latency PUF Outline Motivation Effective PUF Characteristics DRAM Latency PUF DRAM Operation Key Idea Prior Best DRAM PUF: DRAM Retention PUF DRAM Cell Retention Key Idea Weaknesses Methodology Results Summary 3/45

4 The DRAM Latency PUF Outline Motivation Effective PUF Characteristics DRAM Latency PUF DRAM Operation Key Idea Prior Best DRAM PUF: DRAM Retention PUF DRAM Cell Retention Key Idea Weaknesses Methodology Results Summary 4/45

5 Motivation We want a way to ensure that a system s components are not compromised Physical Unclonable Function (PUF): a function we evaluate on a device to generate a signature unique to the device We refer to the unique signature as a PUF response Often used in a Challenge-Response Protocol (CRP) Trusted Device Checking PUF response... Input: Challenge X Output: PUF Response X Authenticated Device Evaluating PUF... 5/45

6 Motivation 1. We want a runtime-accessible PUF - Should be evaluated quickly with minimal impact on concurrent applications - Can protect against attacks that swap system components with malicious parts 2. DRAM is a promising substrate for evaluating PUFs because it is ubiquitous in modern systems - Unfortunately, current DRAM PUFs are slow and get exponentially slower at lower temperatures 6/45

7 The DRAM Latency PUF Outline Motivation Effective PUF Characteristics DRAM Latency PUF DRAM Operation Key Idea Prior Best DRAM PUF: DRAM Retention PUF DRAM Cell Retention Key Idea Weaknesses Methodology Results Summary 7/45

8 Effective PUF Characteristics 1. Repeatability Trusted Device DRAM Device PUF Response 1 PUF 0 Response N PUF Response 0 == PUF Response 0 8/45

9 Effective PUF Characteristics 1. Repeatability 2. Diffuseness Trusted Device Challenge 1... PUF Response 0 DRAM Device 0 PUF Response 0 PUF Response 1 PUF Response N 9/45

10 Effective PUF Characteristics 1. Repeatability 2. Diffuseness 3. Uniform Randomness Cannot use multiple challenge-response pairs to guess another Trusted Device Challenge 1... PUF Response PUF 0 Response PUF 0 Response 1 PUF 0 Response N DRAM Device PUF Response 0 PUF Response 1 PUF Response N 10/45

11 Effective PUF Characteristics 1. Repeatability 2. Diffuseness 3. Uniform Randomness 4. Uniqueness DRAM Device 1 PUF Response Z Trusted Device Challenge Z DRAM Device 0 PUF Response Z All PUF responses of different devices are significantly different DRAM Device 2 PUF Response Z 11/45

12 Effective PUF Characteristics 1. Repeatability 2. Diffuseness 3. Uniform Randomness 4. Uniqueness 5. Unclonability Trusted Device PUF Response 0 PUF Response 1 PUF 0 Response N DRAM Device 0 DRAM Device 12/45

13 Effective PUF Characteristics 1. Repeatability 2. Diffuseness 3. Uniform Randomness 4. Uniqueness 5. Unclonability Trusted Device More analysis PUF Response 0 PUF Response 1 PUF 0 Response N DRAM Device of the effective PUF characteristics in the paper 13/45

14 Effective PUF Characteristics Runtime-accessible PUFs must have 1. Low Latency - Each device can quickly generate a PUF response 2. Low System Interference - PUF evaluation minimally affects performance of concurrently-running applications 14/45

15 The DRAM Latency PUF Outline Motivation Effective PUF Characteristics DRAM Latency PUF DRAM Operation Key Idea Prior Best DRAM PUF: DRAM Retention PUF DRAM Cell Retention Key Idea Weaknesses Methodology Results Summary 15/45

16 DRAM Accesses and Failures Bitline Voltage V dd V min wordline access transistor capacitor Ready to Access Voltage Level bitline Sense Amplifier Bitline Charge Sharing Guardband Process variation during manufacturing results in cells having unique behavior Strong Weak 0.5 V dd Time ACTIVATE SA Enable READ t RCD 16/45

17 DRAM Accesses and Failures Bitline Voltage V dd V min Ready to Access Voltage Level wordline capacitor access transistor SA bitline Weaker cells have a higher probability to fail Strong Weak 0.5 V dd ACTIVATE SA Enable Time READ t RCD 17/45

18 The DRAM Latency PUF Outline Motivation Effective PUF Characteristics DRAM Latency PUF DRAM Operation Key Idea Prior Best DRAM PUF: DRAM Retention PUF DRAM Cell Retention Key Idea Weaknesses Methodology Results Summary 18/45

19 DRAM Latency PUF Key Idea A cell s latency failure probability is inherently related to random process variation from manufacturing We can provide repeatable and unique device signatures using latency error patterns High % chance to fail with reduced t RCD Low % chance to fail with reduced t RCD Row Decoder SA SA SA SA SA SA SA 19/45

20 DRAM Latency PUF Key Idea A cell s latency failure probability is inherently related to random process variation from manufacturing We can provide repeatable and unique device signatures using latency error patterns High % chance to fail with reduced t RCD Row Decoder Low % chance to fail with reduced t RCD The key idea is to compose a PUF response using the DRAM cells that fail with high probability SA SA SA SA SA SA SA 20/45

21 Evaluating a DRAM Latency PUF Determine whether a single cell s location should be included in a DRAM latency PUF response - Include if the cell fails with a probability greater than a chosen threshold when accessed with a reduced t RCD Chosen Threshold: 50% 1 SA This Cell s Failure Rate: 60% Failure rate is greater than the chosen threshold, so the cell s location should be included /45

22 Evaluating a DRAM Latency PUF We induce latency failures 100 times and use a threshold of 10% (i.e., use cells that fail > 10 times) We do this for every cell in a continuous 8KiB memory region, that we refer to as a PUF memory segment Example 21-bit PUF memory segment Row Decoder SA SA SA SA SA SA SA 22/45

23 Evaluating a DRAM Latency PUF We induce latency failures 100 times and use a threshold of 10% (i.e., use cells that fail > 10 times) We do this for every cell in a continuous 8KiB memory region, that we refer to as a PUF memory segment PUF Response /45

24 Evaluating a DRAM Latency PUF We induce latency failures 100 times and use a threshold of 10% (i.e., use cells that fail > 10 times) We do this for every cell in a continuous 8KiB memory region, that we refer to as a PUF memory segment We can evaluate PUF Response the DRAM latency PUF in only 88.2ms on average regardless of temperature! /45

25 The DRAM Latency PUF Outline Motivation Effective PUF Characteristics DRAM Latency PUF DRAM Operation Key Idea Prior Best DRAM PUF: DRAM Retention PUF DRAM Cell Retention Key Idea Weaknesses Methodology Results Summary 25/45

26 DRAM Cell Leakage DRAM encodes information in leaky capacitors wordline access transistor capacitor charge leakage paths bitline Stored data is corrupted if too much charge leaks (i.e., the capacitor voltage degrades too much) [Patel et al., REAPER, ISCA 17] 26/45

27 DRAM Cell Retention Capacitor voltage (Vdd) 100% Vmin 0% Retention time time Retention failure when leakage corrupts stored data Retention time how long a cell holds its value [Patel et al., REAPER, ISCA 17] 27/45

28 Each Cell has a Different Retention Time wordline capacitor Row Decoder access transistor bitline Row Buffer 8GB DRAM = 6.4e10 cells [Patel et al., REAPER, ISCA 17] 28/45

29 The DRAM Latency PUF Outline Motivation Effective PUF Characteristics DRAM Latency PUF DRAM Operation Key Idea Prior Best DRAM PUF: DRAM Retention PUF DRAM Cell Retention Key Idea Weaknesses Methodology Results Summary 29/45

30 Evaluating a DRAM Retention PUF Generate a PUF response with locations of cells in a PUF memory segment that fail with a refresh interval N Row Decoder SA SA SA SA SA SA SA SA SA SA Can handle a longer refresh interval Fails with refresh interval N The pattern of retention failures across a segment of DRAM is unique to the device 30/45

31 Evaluating a DRAM Retention PUF Generate a PUF response with locations of cells in a PUF memory segment that fail with a refresh interval N Row Decoder We use the best methods SA SA SA SA SA from prior work SA SA SA SA SA Can handle a longer refresh interval Fails with refresh interval X and optimize the retention PUF for our devices The pattern of retention failures across a segment of DRAM is unique to the device 31/45

32 The DRAM Latency PUF Outline Motivation Effective PUF Characteristics DRAM Latency PUF DRAM Operation Key Idea Prior Best DRAM PUF: DRAM Retention PUF DRAM Cell Retention Key Idea Weaknesses Methodology Results Summary 32/45

33 DRAM Retention PUF Weaknesses DRAM Retention PUF evaluation time is very long and leads to high system interference Long evaluation time: 1. Most DRAM cells are strong à need to wait for long time to drain charge from capacitors 2. Especially at low temperatures High system interference: 1. DRAM refresh can only be disabled at a channel granularity (512MB 2GB) 2. Must issue manual refreshes to maintain data correctness in the rest of the channel during entire evaluation time 3. Manually refreshing DRAM consumes significant bandwidth on the DRAM bus 33/45

34 DRAM Retention PUF Weaknesses Long evaluation time could be ameliorated in 2 ways: 1. Increase temperature higher rate of charge leakage à Observe failures faster Unfortunately: 1. Difficult to control DRAM temperature in the field 2. Operating at high temperatures is undesirable 2. Increase PUF memory segment size more cells with low retention time in PUF memory segment à Observe more failures faster Unfortunately: Large PUF memory segment à high DRAM capacity overhead 34/45

35 The DRAM Latency PUF Outline Motivation Effective PUF Characteristics DRAM Latency PUF DRAM Operation Key Idea Prior Best DRAM PUF: DRAM Retention PUF DRAM Cell Retention Key Idea Weaknesses Methodology Results Summary 35/45

36 Methodology 223 2y-nm LPDDR4 DRAM devices - 2GB device size - From 3 major DRAM manufacturers Thermally controlled testing chamber - Ambient temperature range: {40 C 55 C} ± 0.25 C - DRAM temperature is held at 15 C above ambient Precise control over DRAM commands and timing parameters - Test retention time effects by disabling refresh - Test reduced latency effects by reducing t RCD parameter 36/45

37 The DRAM Latency PUF Outline Motivation Effective PUF Characteristics DRAM Latency PUF DRAM Operation Key Idea Prior Best DRAM PUF: DRAM Retention PUF DRAM Cell Retention Key Idea Weaknesses Methodology Results Summary 37/45

38 Results PUF Evaluation Latency Evaluation Evaluation Time Time (s) (s) KiB memory segment DRAM Retention PUF DRAM Retention PUF Manufacturer Manufacturer A Manufacturer Manufacturer B Manufacturer Manufacturer C DRAM Latency PUF DRAM Latency PUF All Manufacturers All Manufacturers 33,806.6x 318.3x 8KiB memory segment o Temperature ( C) C) DRAM latency PUF is 1. Fast and constant latency (88.2ms) 38/45

39 Results PUF Evaluation Latency Evaluation Evaluation Time Time (s) (s) KiB memory segment 64KiB memory segment DRAM Retention PUF DRAM Retention PUF Manufacturer Manufacturer A Manufacturer Manufacturer B Manufacturer Manufacturer C DRAM Latency PUF DRAM Latency PUF All Manufacturers All Manufacturers 869.8x 108.9x o Temperature ( C) C) DRAM latency PUF is 8KiB memory segment 1. Fast and constant latency (88.2ms) 39/45

40 Results PUF Evaluation Latency Evaluation Evaluation Time Time (s) (s) KiB memory segment 64KiB memory segment 64MiB memory segment 17.3x DRAM Retention PUF DRAM Retention PUF Manufacturer Manufacturer A Manufacturer Manufacturer B Manufacturer Manufacturer C DRAM Latency PUF DRAM Latency PUF All Manufacturers All Manufacturers o Temperature ( C) C) DRAM latency PUF is 8KiB memory segment 1. Fast and constant latency (88.2ms) 11.5x 40/45

41 Results PUF Evaluation Latency Evaluation Evaluation Time Time (s) (s) KiB memory segment 64MiB memory segment 8KiB memory segment DRAM Retention PUF DRAM Retention PUF Manufacturer Manufacturer A Manufacturer Manufacturer B Manufacturer Manufacturer C DRAM Latency PUF DRAM Latency PUF All Manufacturers All Manufacturers o Temperature ( C) C) DRAM latency PUF is 8KiB memory segment 1. Fast and constant latency (88.2ms) 2. On average, 102x/860x faster than the previous DRAM PUF with the same DRAM capacity overhead (64KiB) 41/45

42 Results System Interference During PUF evaluation on commodity devices: The DRAM Retention PUF - Disables refresh at channel granularity (~512MB 2GB) Issue manual refresh operations to rows in channel but not in PUF memory segment to prevent data corruption - Has long evaluation time at low temperatures The DRAM Latency PUF - Does not require disabling refresh - Has short evaluation time at any operating temperature 42/45

43 Other Results in the Paper How the DRAM latency PUF meets the basic requirements for an effective PUF A detailed analysis on: - Devices of the three major DRAM manufacturers - The evaluation time of a PUF Further discussion on: - Optimizing retention PUFs - System interference of DRAM retention and latency PUFs - Algorithm to quickly and reliably evaluate DRAM latency PUF - Design considerations for a DRAM latency PUF - The DRAM Latency PUF overhead analysis 43/45

44 The DRAM Latency PUF Outline Motivation Effective PUF Characteristics DRAM Latency PUF DRAM Operation Key Idea Prior Best DRAM PUF: DRAM Retention PUF DRAM Cell Retention Key Idea Weaknesses Methodology Results Summary 44/45

45 Executive Summary Motivation: We can authenticate a system via unique signatures if we can evaluate a Physical Unclonable Function (PUF) on it Signatures (PUF response) reflect inherent properties of a device DRAM is a promising substrate for PUFs because it is widely used Problem: Current DRAM PUFs are 1) very slow, 2) require a DRAM reboot, or 3) require additional custom hardware Goal: To develop a novel and effective PUF for existing commodity DRAM devices with low-latency evaluation time and low system interference across all operating temperatures DRAM Latency PUF: Reduce DRAM access latency below reliable values and exploit the resulting error patterns as unique identifiers Evaluation: 1. Experimentally characterize 223 real LPDDR4 DRAM devices 2. DRAM latency PUF (88.2 ms) achieves a speedup of 102x/860x at 70 C/55 C over prior DRAM PUF evaluation mechanisms 45/45

46 The DRAM Latency PUF: Quickly Evaluating Physical Unclonable Functions by Exploiting the Latency-Reliability Tradeoff in Modern Commodity DRAM Devices Jeremie S. Kim Minesh Patel Hasan Hassan Onur Mutlu

47 47/45

48 DRAM Architecture Background Row Decoder Wordline Access Transistor Capacitor Bitline Sense Amplifiers Row Decoder Cell Rows Sense Amplifiers DRAM Cell Array 0 DRAM Cell Array N Columns Chip 0 Chip N Bank 0 Rank 0 Bank N Rank N I/O BUS DRAM Channel 0 I/O BUS Memory Controller 0 CPU DRAM Channel N I/O BUS Memory Controller N (a) DRAM Cell Array (b) DRAM Bank (c) DRAM Channel Figure 1: DRAM organization. (d) DRAM-Based System 48/45

49 Evaluating DRAM Retention PUFs Algorithm 1: Evaluate Retention PUF [103, 120, 121, 124, 135] 1 evaluate_dram_retention_puf(seg_id, wait_time): 2 rank_id Ω DRAM rank containing seg_id 3 disable refresh for Rank[rank_id] 4 start_time Ω current_time() 5 while current_time() - start_time < wait_time: 6 foreach row in Rank[rank_id]: 7 if row not in Segment[seg_id]: 8 issue refresh to row // refresh all other rows 9 enable refresh for Rank[rank_id] 10 return data at Segment[seg_id] ation time for the same PUF memory segment increases by 49/45

50 #Chips #Tested Memory Segments A 91 17,408 B 65 12,544 C 67 10,580 Table 1: The number of tested PUF memory segments across the tested chips from each of the three manufacturers. For each memory segment, we evaluate the PUF 50 times 50/45

51 Figure 3: Distributions of Jaccard indices calculated across every possible pair of PUF responses across all tested PUF memory segments from each of 223 LPDDR4 DRAM chips. To understand manufacturer-related eects, Figure 4 sepa- 51/45

52 manufacturers are tightly distributed close to 0 (not shown). Figure 4: Distributions of Jaccard indices calculated between PUF responses of DRAM chips from a single manufacturer Unclonability. We attribute the probabilistic behavior 52/45

53 fraction of memory segments per chip that are observed to segments across n devices, where n is in 90% the left hibit have Intra-Jaccard index ranges below 0.1indicated and 0.2. Over column, the rows indicate di erent manufacturers or C. of alland segments in each chip arethe suitable for PUF evaluation of resthe 3 chips containingindex the memory segments. for Intra-Jaccard ranges below 0.1, and over 97% for ty. Intra-Jaccard index ranges#total below 0.2. This means that each #Chips Memory Segments abil- chip has a signi cant number of memory segments that are A ,824 a 30- viable for DRAM latency PUF evaluation. Furthermore, the B are very 12 narrow, which 442,879 s for distributions indicates that di erent 437,990 that every chip has es a chips showcsimilar14behavior. We conclude key a signi cant number of PUF memory segments that exhibit 2: Number of PUF memory segments tested 7.5 forhow 30 days. netable a high repeatability across time. We show in Section cross Inwe can use a simple characterization step to identify these order to demonstrate the repeatability of evaluating a own viable memory segments quickly and reliably. DRAM latency PUF over long periods of time, we continumory %Memory Segments per across Chip ously evaluate our DRAM latency PUF a 30-day period left Intra-Jaccard index range <0.1 Intra-Jaccard index range <0.2 using each of our [99.08, chosen memory segments. For each memrs of A ] [100.00, ] ory segment, we calculate B [82.13, 99.96] the Intra-Jaccard [95.37, index ] between the rst response and each subsequent PUF response. C PUF [89.20, ] [95.48, ] We nd Intra-Jaccard index range, or theper range values Tablethe 3: Percentage of PUF memory segments chipof with (max_value min_value) Jaccard indices Intra-Jaccard index ranges found <0.1 or across 0.2 overthe a 30-day period. Median for [minimum, maximum] values are shown. calculated every pair of PUF responses from a memory days. segment. If a memory segment exhibits ahow lowchanges Intra-Jaccard Temperature E ects. To demonstrate in 53/45 range, thea ect memory segment we generates PUF evaluation, evaluate highly-similar the DRAM ng index a temperature

54 Temperature Effects eect during device enrollment. Figure 6: DRAM latency PUF repeatability vs. temperature. o 54/45

55 Evaluating a DRAM Latency PUF Algorithm 2: Evaluate DRAM latency PUF 1 evaluate_dram_latency_puf(seg_id): 2 write known data (all 1 s) to Segment[seg_id] 3 rank_id Ω DRAM rank containing seg_id 4 obtain exclusive access to Rank[rank_id] 5 set low t RCD for Rank[rank_id] 6 for i = 1 to num_iterations : 7 for col in Segment[seg_id] 8 for row in Segment[seg_id]: // column-order reads 9 read() // induce read failures 10 memory_barrier() // one access at a time 11 count_failures() // record in another rank 12 set default t RCD for Rank[rank_id] 13 lter the PUF memory segment // See Filtering Mechanism 14 release exclusive access to Rank[rank_id] 15 return error pattern at Segment[seg_id] location should be set ( 1 ) or cleared ( 0 ) in the nal PUF 55/45

56 bit location. Otherwise, we clear it. Memory Footprint. Equation 2 provides the memory footprint required by PUF evaluation: mem total = (size mem_seg )+(size counter_buer ) (2) where size mem_seg is the size of the PUF memory segment and size counter_buer is the size of the counter buer. The size of the counter buer can be calculated using Equation 3: size counter_buer = (size mem_seg ) Álog 2 N iters Ë (3) where size _ is the size of the PUF memory segment 56/45

57 #Chips Good Memory Segments per Chip (%) A [100.00, ] B [64.06, ] C [19.37, 95.31] Table 4: Percentage of good memory segments per chip across manufacturers. Median [min, max] values are shown Support for Changing Timing Parameters 57/45

58 DRAM Characterization 58/45

59 Sources of Retention Time Variation Process/voltage/temperature Data pattern dependence (DPD) - Retention times change with data in cells/neighbors - e.g., all 1 s vs. all 0 s Variable retention time (VRT) - Retention time changes randomly (unpredictably) - Due to a combination of various circuit effects 59/45

60 Long-term Continuous Profiling # New Failing Cells Representative chip from Vendor B, 2048ms, 45 C Error correction codes (ECC) and online profiling are necessary to manage new failing cells Time (days) New failing cells continue to appear over time - Attributed to variable retention time (VRT) The set of failing cells changes over time 60/45

61 Single-cell Failure Probability (Cartoon) Probability of Read Failure idealized cell (retention time = 3s) Refresh Interval (s) actual cell N(μ, σ) μ = 3s 61/45

62 Single-cell Failure Probability (Real) operate here profile here Read Failure Probability hard to find Refresh Interval (s) easy to find Any cell is more likely to fail at a longer refresh interval failed 9 times out of 16 trials OR a higher temperature false positives 62/45

63 Temperature Relationship Well-fitting exponential relationship: E.g., 10 C ~ 10x more failures 63/45

64 Retention 45 C 64/45

65 VRT Failure Accumulation Rate 65/45

66 800 Rounds of 2048ms, 45 C 66/45

67 800 Rounds of 2048ms, 45 C 67/45

68 Individual Cell Failure Probabilities Single representative chip of Vendor B at 40 C Refresh intervals ranging from 64ms to 4096ms 68/45

69 Individual Cell Failure Distributions 69/45

70 Single-cell Failures With Temperature Single representative chip of Vendor B {mean, std} for cells between 64ms and 4096ms 70/45

A DRAM based Physical Unclonable Function Capable of Generating >10 32 Challenge Response Pairs per 1Kbit Array for Secure Chip Authentication

A DRAM based Physical Unclonable Function Capable of Generating >10 32 Challenge Response Pairs per 1Kbit Array for Secure Chip Authentication Q. Tang, C. Zhou, *W. Choi, *G. Kang, *J. Park, K. K. Parhi,