Vulnerabilities in MLC NAND Flash Memory Programming Experimental

Vulnerabilities in MLC NAND Flash Memory Programming: Experimental Analysis, Exploits, and Mitigation Techniques HPCA Session 3 A – Monday, 3: 15 PM, Salon F 128 GB NAND Flash 256 GB NAND Flash 01 11 11 00 11 10 00 10 NAND flash scaling: shrink size of each flash cell, store two bits per cell

Vulnerabilities in MLC NAND Flash Memory Programming: Experimental Analysis, Exploits, and Mitigation Techniques HPCA Session 3 A – Monday, 3: 15 PM, Salon F 128 GB NAND Flash 256 GB NAND Flash 01 11 11 00 11 10 00 10 NAND flash scaling: shrink size of each flash cell, store two bits per cell 10 11 ? ? 10 Program 00 10 As the cells become smaller, they interfere with each other during

Vulnerabilities in MLC NAND Flash Memory Programming: Experimental Analysis, Exploits, and Mitigation Techniques HPCA Session 3 A – Monday, 3: 15 PM, Salon F 128 GB NAND Flash 256 GB NAND Flash 01 11 11 00 11 10 00 10 NAND flash scaling: shrink size of each flash cell, store two bits per cell 10 11 ? ? 10 Program 00 10 ? ? Step 1 ? 0 Step 2 00 …to reduce interference, As the cells become smaller, they today’s MLC NAND flash chips use interfere with each other during two-step programming

Vulnerabilities in MLC NAND Flash Memory Programming: Experimental Analysis, Exploits, and Mitigation Techniques HPCA Session 3 A – Monday, 3: 15 PM, Salon F Using real MLC NAND flash chips, we show that two-step programming introduces new reliability and security vulnerabilities

Vulnerabilities in MLC NAND Flash Memory Programming: Experimental Analysis, Exploits, and Mitigation Techniques HPCA Session 3 A – Monday, 3: 15 PM, Salon F Using real MLC NAND flash chips, we show that two-step programming introduces new reliability and security vulnerabilities Controller We find that cells with only one bit MSB data programmed are more vulnerable to interference during reads and writes Read Without than fully-programmed cells Errors Flash Memory. . . MSB LSB . . . MSB n LSB 0 LSB 1. . . LSB n MSB 0 MSB 1 Read With Errors

Vulnerabilities in MLC NAND Flash Memory Programming: Experimental Analysis, Exploits, and Mitigation Techniques HPCA Session 3 A – Monday, 3: 15 PM, Salon F Using real MLC NAND flash chips, we show that two-step programming introduces new reliability and security vulnerabilities Controller We find that cells with only one bit MSB data programmed are more vulnerable to interference during reads and writes Read Without than fully-programmed cells Error Rate Errors ECC Limit ous i c i l a M al m r o N Lifetime Flash Memory. . . MSB LSB . . . MSB n LSB 0 LSB 1. . . LSB n MSB 0 MSB 1 Read With Errors Vulnerabilities can be exploited to corrupt data and reduce flash lifetime

Vulnerabilities in MLC NAND Flash Memory Programming: Experimental Analysis, Exploits, and Mitigation Techniques HPCA Session 3 A – Monday, 3: 15 PM, Salon F We propose three solutions to minimize vulnerabilities at negligible latency overhead

Vulnerabilities in MLC NAND Flash Memory Programming: Experimental Analysis, Exploits, and Mitigation Techniques HPCA Session 3 A – Monday, 3: 15 PM, Salon F We propose three solutions to minimize vulnerabilities at negligible latency overhead One solution completely eliminates vulnerabilities 4. 9% increase in flash programming latency

Vulnerabilities in MLC NAND Flash Memory Programming: Experimental Analysis, Exploits, and Mitigation Techniques HPCA Session 3 A – Monday, 3: 15 PM, Salon F Lifetime (P/E Cycles) We propose three solutions to minimize vulnerabilities at negligible latency overhead 0 K One solution completely eliminates vulnerabilities 4. 9% increase in flash programming latency Two other solutions mitigate vulnerabilities 0 K 16% Solution #3 Baseline 0 K No increase in flash latency, errors not completely eliminated 0 K 0 Increases flash lifetime by 16% 0 K 0 K 0 K Read Disturb Count 0 K

Vulnerabilities in MLC NAND Flash Memory Programming: Experimental Analysis, Exploits, and Mitigation Techniques HPCA Session 3 A – Monday, 3: 15 PM, Salon F Lifetime (P/E Cycles) We propose three solutions to minimize vulnerabilities at negligible latency overhead 0 K One solution completely eliminates vulnerabilities 4. 9% increase in flash programming latency Two other solutions mitigate vulnerabilities 0 K 16% Solution #3 Baseline 0 K No increase in flash latency, errors not completely eliminated 0 K 0 Increases flash lifetime by 16% 0 K 0 K 0 K Read Disturb Count 0 K Want more? Come to our talk! Read our paper! Authors: Yu Cai, Saugata Ghose, Yixin Luo, Ken Mai, Onur Mutlu, Erich F.