[Paper Review] Side Channel Attacks on STTRAM and Low-Overhead Countermeasures

Nitin Rathi, Helia Naeimi+1 more|arXiv (Cornell University)|Mar 22, 2016

Semiconductor materials and devices3 citations

TL;DR

This paper presents a side-channel attack on Spin-Transfer Torque RAM (STTRAM) that exploits variations in supply current during write operations to infer sensitive data, leveraging the dependence of write latency and current on data polarity. It proposes low-overhead countermeasures—short retention STTRAM, 1-bit parity, multi-bit random writes, and constant current write drivers—that reduce distinguishable current signatures by up to 30% and significantly hinder attacker recovery of full data words.

ABSTRACT

Spin Transfer Torque RAM (STTRAM) is a promising candidate for Last Level Cache (LLC) due to high endurance, high density and low leakage. One of the major disadvantages of STTRAM is high write latency and write current. Additionally, the latency and current depends on the polarity of the data being written. These features introduce major security vulnerabilities and expose the cache memory to side channel attacks. In this paper we propose a novel side channel attack model where the adversary can monitor the supply current of the memory array to partially identify the sensitive cache data that is being read or written. We propose several low cost solutions such as short retention STTRAM, 1-bit parity, multi-bit random write and constant current write driver to mitigate the attack. 1-bit parity reduces the number of distinct write current states by 30% for 32-bit word and the current signature is further obfuscated by multi-bit random writes. The constant current write makes it more challenging for the attacker to extract the entire word using a single supply current signature.

Motivation & Objective

• To identify and exploit side-channel vulnerabilities in STTRAM due to data-dependent write current and latency.
• To analyze how supply current variations during write operations can leak sensitive cache data.
• To design low-cost, hardware-efficient countermeasures that minimize side-channel leakage without sacrificing performance or area.

Proposed method

• Proposes a side-channel model where an adversary monitors supply current to infer data being written to STTRAM.
• Introduces short retention STTRAM to reduce the time window for current signature analysis.
• Employs 1-bit parity to reduce the number of distinct write current states by 30% for 32-bit words.
• Applies multi-bit random writes to obfuscate the actual data being written, increasing entropy of current traces.
• Designs a constant current write driver to mask data-dependent current variations.
• Combines multiple countermeasures to minimize distinguishable current signatures and prevent full data recovery.

Experimental results

Research questions

• RQ1 Can supply current variations in STTRAM be exploited to extract sensitive data during write operations?
• RQ2 How does data polarity affect write current and latency in STTRAM, and can this be leveraged for side-channel attacks?
• RQ3 To what extent can 1-bit parity reduce the number of distinguishable current states in STTRAM writes?
• RQ4 How effective are multi-bit random writes and constant current drivers in obscuring side-channel leakage?
• RQ5 Can low-overhead countermeasures be designed that do not significantly impact area, power, or performance?

Key findings

• The 1-bit parity scheme reduces the number of distinct write current states by 30% for 32-bit words, decreasing the attack surface.
• Multi-bit random writes effectively obfuscate the actual data being written, increasing the difficulty of current trace analysis.
• The constant current write driver makes it significantly harder for an attacker to extract the entire data word from a single current signature.
• The combination of short retention STTRAM and random writes reduces the time window and entropy of observable side-channel signals.
• The proposed countermeasures are low-cost and do not require major architectural changes, making them practical for real-world deployment.