Self-healing and secure low-power memory systems Mădălin Neagu ADVERTIMENT La consulta d’aquesta tesi queda condicionada a l’acceptació de les següents condicions d'ús: La difusió d’aquesta tesi per mitjà del repositori institucional UPCommons (http://upcommons.upc.edu/tesis) i el repositori cooperatiu TDX ( http://www.tdx.cat/) ha estat autoritzada pels titulars dels drets de propietat intel·lectual únicament per a usos privats emmarcats en activitats d’investigació i docència. No s’autoritza la seva reproducció amb finalitats de lucre ni la seva difusió i posada a disposició des d’un lloc aliè al servei UPCommons o TDX. No s’autoritza la presentació del seu contingut en una finestra o marc aliè a UPCommons (framing). Aquesta reserva de drets afecta tant al resum de presentació de la tesi com als seus continguts. En la utilització o cita de parts de la tesi és obligat indicar el nom de la persona autora. ADVERTENCIA La consulta de esta tesis queda condicionada a la aceptación de las siguientes condiciones de uso: La difusión de esta tesis por medio del repositorio institucional UPCommons (http://upcommons.upc.edu/tesis) y el repositorio cooperativo TDR (http://www.tdx.cat/?locale- attribute=es) ha sido autorizada por los titulares de los derechos de propiedad intelectual únicamente para usos privados enmarcados en actividades de investigación y docencia. No se autoriza su reproducción con finalidades de lucro ni su difusión y puesta a disposición desde un sitio ajeno al servicio UPCommons No se autoriza la presentación de su contenido en una ventana o marco ajeno a UPCommons (framing). Esta reserva de derechos afecta tanto al resumen de presentación de la tesis como a sus contenidos. En la utilización o cita de partes de la tesis es obligado indicar el nombre de la persona autora. WARNING On having consulted this thesis you’re accepting the following use conditions: Spreading this thesis by the institutional repository UPCommons (http://upcommons.upc.edu/tesis) and the cooperative repository TDX (http://www.tdx.cat/?locale- attribute=en) has been authorized by the titular of the intellectual property rights only for private uses placed in investigation and teaching activities. Reproduction with lucrative aims is not authorized neither its spreading nor availability from a site foreign to the UPCommons service. Introducing its content in a window or frame foreign to the UPCommons service is not authorized (framing). These rights affect to the presentation summary of the thesis as well as to its contents. In the using or citation of parts of the thesis it’s obliged to indicate the name of the author. SELF-HEALING AND SECURE LOW-POWER MEMORY SYSTEMS Supervisors: Author: Joan FIGUERAS Mad˘ alin˘ NEAGU Salvador MANICH September 2017 ii SELF-HEALING AND SECURE LOW-POWER MEMORY SYSTEMS Tesi doctoral presentada per a l’obtencio´ del t´ıtol de Doctor per la Universitat Politecnica` de Catalunya, dins el Programa de Doctorat en Enginyeria Electronic` Supervisors: Author: Joan FIGUERAS Mad˘ alin˘ NEAGU Salvador MANICH Barcelona, September 2017 ii Abstract Memory systems store critical information in any digital system, thus they are sus- ceptible to transient errors and are the focus of various types of attacks. It is crucial for a memory system to keep the information as accurate as possible. There is a need to design, implement and test systems capable of handling errors by them- selves, thus, to run autonomously. Self-healing capabilities for memory systems translates into error detecting and correcting codes and replacing/replicating meth- ods of memory elements. Security and data privacy is difficult to implement in memory systems, due to the overwhelming variety of attacks. This thesis pro- poses strategies against specific attacks that can occur in memory systems. The self-healing methodology and the security solutions are evaluated from varied per- spectives: performance, area and delay overhead, and power consumption. Keywords— error detection, error correction, memory systems, data scram- bling, cache memories, side-channel attack, simple and differential power analysis iii iv Prologue The main objective of this thesis is to bring new contributions to the self-healing and secure systems domain. In particular, to develop a self-healing technique for memory systems and to increase security of memory systems, techniques which favor low-power consumption. In order to achieve the main objective, three ma- jor research objectives were proposed: design of an error detection and correction scheme for errors that occur in memory systems and integrate them in a memory system, design techniques to increase the security and data privacy of memory sys- tems against different types of attacks and to combine the previous two into a single solution, in order to achieve a self-healing and secure low-power memory system. The low-power aspect of the proposed solutions and techniques is evaluated dur- ing design stage and afterwards through simulation. Also, the architectures are evaluated from several other points of view, such as error detecting and correcting performance, area and delay overhead, and security efficiency. I want to thank all the people who have helped and supported this doctoral thesis. I would like to express my sincere gratitude to prof. Salvador Manich for introducing me to the security domain, for the continuous support of my Ph.D study and related research, for his patience, motivation and immense knowledge. His guidance helped me in all the time of research and writing of this thesis. I also want to thank prof. Joan Figueras for indicating a research direction and for stimulating me during the doctoral program and, last but not least, I want to thank prof. Liviu Miclea for the support and encouragement. I would like to thank my family, especially my wife and parents for supporting me spiritually throughout writing this thesis and my life in general. This PhD thesis has been partially sponsored by the Spanish government project TEC2013-41209-P. v vi Contents 1 Introduction 1 1.1 Context . .1 1.2 State of the art . .2 1.2.1 Motivation . .2 1.2.2 Introduction . .4 1.2.3 The Self-Healing concept . .8 1.2.4 Memory systems . .9 1.2.5 Low-power systems . 10 1.2.6 Security in memory systems . 12 1.3 Objectives . 13 1.4 Structure . 15 2 Unidirectional eDLC 17 2.1 Introduction . 17 2.2 Motivation . 18 2.3 Theoretical background . 19 2.3.1 Memory systems . 20 2.3.2 Sources of errors in SRAM and DRAM memories . 29 2.3.3 Self-healing memory systems through error detection and correction schemes . 32 2.4 Proposed solution . 46 2.4.1 Modified Berger codes . 46 2.4.2 Coding schemes . 49 2.4.3 Error localization . 52 2.4.4 Error correction . 58 2.4.5 Error escapes . 59 2.5 Implementation . 60 2.5.1 Cadence implementation . 60 vii viii CONTENTS 2.5.2 Integrating the proposed self-healing technique in memory systems . 61 2.6 Experimental results and evaluation . 68 2.6.1 Code delay . 72 2.6.2 Code redundancy . 72 2.6.3 Error localization ambiguity . 73 2.6.4 Error correction . 73 2.6.5 Error escapes . 74 2.6.6 Area of the code generator and memory resources . 75 2.6.7 Power consumption . 77 2.6.8 Delay . 77 2.6.9 Overall evaluation . 80 2.7 Conclusions . 82 3 Security in cache memories (IST) 85 3.1 Introduction . 85 3.2 Theoretical background . 86 3.3 Data scrambling . 87 3.4 Statement of the problem . 92 3.5 Proposed solution: Interleaved Scrambling Technique (IST) . 93 3.5.1 Scrambler Table . 94 3.5.2 Cache Memory . 100 3.5.3 Read and write cycles . 101 3.6 IST performance and efficiency . 104 3.6.1 Time performance . 104 3.6.2 Power efficiency . 105 3.7 Evaluation and experimental results . 108 3.7.1 CACTI tool evaluation . 108 3.7.2 FPGA model evaluation . 112 3.8 Conclusions . 114 4 Defeating SPEMA and DPEMA 115 4.1 Introduction . 115 4.2 Motivation . 116 4.3 Theoretical background . 116 4.3.1 Attacks on memory . 116 4.3.2 Cold-boot attacks . 117 4.4 Securing memory at hardware level . 119 4.4.1 Main memory . 119 4.4.2 Cache memory . 120 CONTENTS ix 4.4.3 Interleaved Scrambling Technique . 121 4.5 Power (P) and Electromagnetic (EM) Radiation Analysis . 122 4.5.1 Simple P or EM Radiation Analysis Attack . 124 4.5.2 Differential P or EM Radiation Analysis Attack . 125 4.5.3 Attack model . 126 4.6 Statement of the Problem . 127 4.6.1 Objective . 129 4.7 Proposed solution for defeating SPEMA . 129 4.7.1 eDLC review and integration with IST . 129 4.7.2 Scrambling vector redundancy filter . 132 4.8 Proposed solution for defeating DPEMA . 136 4.8.1 Example of DPEMA attack on ISTe . 137 4.8.2 DPEMA countermeasure . 140 4.8.3 How it works . 142 4.9 Evaluation and experimental results . 144 4.9.1 Leakage function . 144 4.9.2 Results . 147 4.9.3 Implementation costs . 153 4.10 Conclusions . 161 5 Conclusions 163 5.1 Scientific contributions . 166 5.2 Future research and developments . 170 Bibliography 171 x CONTENTS List of Figures 1.1 Conceptual model of the autonomic system [9] . .5 1.2 SOC Consumer Portable Design Complexity Trends [1] . .7 1.3 SOC Consumer Portable Power Consumption Trends [1] . .7 1.4 Common construction of a memory hierarchy [13] . 10 1.5 Components of a cache memory [14] . 11 2.1 The triangle of balance for EDCs and ECCs. 20 2.2 Basic 6T SRAM cell.