一种基于CRC的DRAM抗电磁故障注入攻击检测方法

Detection Method for DRAM Against EMFI Attacks Based on CRC

摘要

电磁故障注入攻击可以导致动态随机存储器(DRAM)产生多比特错误,威胁到存储数据的安全性．校验码是一种用于检测数据中错误的技术,广泛用于数据存储和传输过程中．然而,在处理多比特错误时,以奇偶校验和汉明纠错码为代表的传统校验方式面临失效的风险．因此,本文提出了一种基于循环冗余校验(CRC)的检测方法,用于检测电磁故障注入攻击在DRAM中引发的错误．首先,基于对错误特征的分析,在读写过程中增加额外校验步骤,实现对错误的检出．其次,针对增加校验带来的存储和传输开销,本文通过构建最优化问题并将各项成本量化,实现不同应用场景下参数的最优选取．最后,对这一方法进行全面评估,搭建故障注入攻击实验,分析其复杂度、检测率、存储和传输等成本．结果表明,所提出的方法能够实现接近100%错误检测率,同时相比于传统校验方法不显著增加计算复杂度．

Abstract

Research indicates that electromagnetic fault injection(EMFI)attacks can cause multibit errors in dynamic random access memory(DRAM)and threaten the security of stored data. Check code is a technology used to detect errors in data and is widely applied in data storage and transmission processes. However, when dealing with multibit errors, the traditional check methods represented by parity check and Hamming code face the risk of failure. Therefore, this paper proposed a solution based on cyclic redundancy check(CRC)to detect errors caused by EMFI attacks in DRAM. First, based on the analysis of error characteristics, additional verification steps were added during the read and write processes to achieve error detection. Second, in response to the storage and transmission overhead caused by the added verification, an optimization problem with the quantified costs was constructed to achieve optimal parameter selection under different application scenarios. Finally, the proposed method was comprehensively evaluated, and a fault injection attack experiment was set up to analyze complexity, detection rate, storage, and transmission costs. Results show that the proposed method can achieve an error detection rate close to 100% while not substantially increasing computational complexity compared with the traditional check methods.

关键词

硬件安全 / 电磁故障注入攻击 / 循环冗余校验 / 动态随机存储器

Key words

hardware security / electromagnetic fault injection(EMFI) attack / cyclic redundancy check(CRC) / dynamic random access memory(DRAM)

参考文献

[1] Narayanan V, Sankaran S. Electromagnetic fault injection attack on ASCON using ChipShouter[C]// IFIP Advances in Information and Communication Technology. Denton, USA, 2024:114-131.

[2] Menu A, Dutertre J M, Rigaud J B, et al. Single—bit laser fault model in nor flash memories: Analysis and exploitation[C]// 2020 Workshop on Fault Detection and Tolerance in Cryptography(FDTC). Piscataway, USA, 2020:41-48.

[3] Viera R, Dutertre J M, Dumont M, et al. Permanent laser fault injection into the flash memory of a microcontroller[C]// 2021 19th IEEE International New Circuits and Systems Conference(NEWCAS). Piscataway, USA, 2021:1-4.

[4] Kim D, Park H, Yeo I, et al. Rowhammer attacks in dynamic random—access memory and defense methods[J]. Sensors, 2024, 24(2):592.

[5] Jattke P, Wipfli M, Solt F, et al. ZenHammer: Rowhammer attacks on AMD zen—based platforms[C]// 33rd USENIX Security Symposium. Berkeley, USA, 2024:1615-1633.

[6] Tang H H, Liu Q. MPFA: An efficient multiple faults—based persistent fault analysis method for low—cost FIA[J]. IEEE Transactions on Computer—Aided Design of Integrated Circuits and Systems, 2021, 41(9):2821-2834.

[7] Jiang Y C, Zhu H F, Shan H Q, et al. TRRScope: Understanding target row refresh mechanism for modern DDR protection[C]// 2021 IEEE International Symposium on Hardware Oriented Security and Trust. Piscataway, USA, 2021:239-247.

[8] Marazzi M, Jattke P, Solt F, et al. ProTRR: Principled yet optimal in—DRAM target row refresh[C]// 43rd IEEE Symposium on Security and Privacy. Piscataway, USA, 2022:735-753.

[9] Yaglikci A G, Patel M, Kim J S, et al. BlockHammer: Preventing rowhammer at low cost by blacklisting rapidly—accessed DRAM rows[C]// 2021 IEEE International Symposium on High—Performance Computer Architecture(HPCA). Seoul, Republic of Korea, 2021:345-358.

[10] Joardar B, Bletsch K, Chakrabarty K, et al. Machine learning—based rowhammer mitigation[J]. IEEE Transactions on Computer—Aided Design of Integrated Circuits and Systems, 2023, 42(5):1395-1405.

[11] Ahr P, Lipps C, Schotten H, et al. DRAM—based physically unclonable functions and the need for proper evaluation[C]// 21st European Conference on Cyber Warfare and Security. Chester, UK, 2022:430-433.

[12] Liu Q, Guo L T, Tang H H. Fault model analysis of DRAM under electromagnetic fault injection attack[C]// 2023 Design, Automation & Test in Europe Conference & Exhibition(DATE). Antwerp, Belgium, 2023:1-6.

[13] Li Y S. Analysis and methodological advancements in software—defined error correction codes[C]// 2024 4th International Signal Processing, Communications and Engineering Management Conference(ISPCEM). Montreal, Canada, 2024:133-138.

[14] Selvi M, Jeeva S, Jaswanth J. Review of performance of LDPC codes for various OFDM systems[C]// 2024 5th International Conference on Mobile Computing and Sustainable Informatics(ICMCSI). Lalitpur, Nepal, 2024:864-869.

[15] Gaine C, Aboulkassimi D, Pontié S, et al. Electromagnetic fault injection as a new forensic approach for SoCs[C]// 2020 IEEE International Workshop on Information Forensics and Security(WIFS). New York, USA, 2020:1-6.

[16] Renner J, Jerkoviys T, Bartz H. Efficient decoding of interleaved low—rank parity—check codes[EB/OL]. https://arxiv.org/abs/1908.10839, 2019—08—28.

[17] Jiang Y N. Analysis of bit error rate between BCH code and convolutional code in picture transmission[C]// 2022 3rd International Conference on Electronic Communication and Artificial Intelligence(IWECAI). Zhuhai, China, 2022:77-80.

[18] Schiller F, Mattes T, Weber U, et al. Undetectable manipulation of CRC checksums for communication and data storage[C]// International Business Conference on Communications and Networking in China. Hangzhou, China, 2008:1-9.

[19] Owunwanne D N. Analysis of the effectiveness of error detection in data transmission using polynomial code method[J]. International Journal of Management & Information Systems, 2010, 14(2):105-112.

[20] Pan Y, Ge N, Dong Z W. CRC look—up table optimization for single—bit error correction[J]. Tsinghua Science & Technology, 2007, 12(5):620-623.

[21] Micron Technology Inc. MT41K64M16TW—107 AAT—J: DDR3 SDRAM Part Catalog[EB/OL]. https://www.micron.com/products/memory/dram—components/ddr3—sdram/part—catalog/part—detail/mt41k64m16tw—107—aat—j, 2018—05—20.

基金资助

国家自然科学基金资助项目(U21B2031)