In cloud computing environments, multiple tenants are often co-located on the same multi-processor system. Thus, preventing information leakage between tenants is crucial. While the hypervisor enforces software isolation, shared hardware, such as the CPU cache or memory bus, can leak sensitive information. For security reasons, shared memory between tenants is typically disabled. Furthermore, tenants often do not share a physical CPU. In this setting, cache attacks do not work and only a slow cross-CPU covert channel over the memory bus is known. In contrast, we demonstrate a high-speed covert channel as well as the first side-channel attack working across processors and without any shared memory. To build these attacks, we use the undocumented DRAM address mappings. We present two methods to reverse engineer the mapping of memory addresses to DRAM channels, ranks, and banks. One uses physical probing of the memory bus, the other runs entirely in software and is fully automated. Using this mapping, we introduce DRAMA attacks, a novel class of attacks that exploit the DRAM row buffer that is shared, even in multi-processor systems. Thus, our attacks work in the most restrictive environments. First, we build a covert channel with a capacity of up to 2 Mbps, which is three to four orders of magnitude faster than memory-bus-based channels. Second, we build a side-channel template attack that can automatically locate and monitor memory accesses. Third, we show how using the DRAM mappings improves existing attacks and in particular enables practical Rowhammer attacks on DDR4.
The increasing DRAM density has led to physically smaller cells, which can thus store smaller charges. As a result, the cells have a lower noise margin and the level of parasitic electrical interaction is potentially higher, resulting in the so-called Rowhammer bug @cite_15 @cite_25 @cite_1 .
@cite_15 @cite_1 @cite_25
2163563130 2953300605 2157116240 2505343551 2532415871 2171856200 2153008620 2056689715 2122087743 2073252511 2034651337 2010630450 2148797773 2175377689 2075293780 2072339605 2057540419 2577263227 2148043530 2084860288
A fundamental assumption in software security is that a memory location can only be modified by processes that may write to this memory location. However, a recent study has shown that parasitic effects in DRAM can change the content of a memory cell without accessing it, but by accessing other memory locations in a high frequency. This so-called Rowhammer bug occurs in most of today's memory modules and has fatal consequences for the security of all affected systems, e.g., privilege escalation attacks. All studies and attacks related to Rowhammer so far rely on the availability of a cache flush instruction in order to cause accesses to DRAM modules at a sufficiently high frequency. We overcome this limitation by defeating complex cache replacement policies. We show that caches can be forced into fast cache eviction to trigger the Rowhammer bug with only regular memory accesses. This allows to trigger the Rowhammer bug in highly restricted and even scripting environments. We demonstrate a fully automated attack that requires nothing but a website with JavaScript to trigger faults on remote hardware. Thereby we can gain unrestricted access to systems of website visitors. We show that the attack works on off-the-shelf systems. Existing countermeasures fail to protect against this new Rowhammer attack. A fundamental assumption in software security is that a memory location can only be modified by processes that may write to this memory location. However, a recent study has shown that parasitic effects in DRAM can change the content of a memory cell without accessing it, but by accessing other memory locations in a high frequency. This so-called Rowhammer bug occurs in most of today's memory modules and has fatal consequences for the security of all affected systems, e.g., privilege escalation attacks. All studies and attacks related to Rowhammer so far rely on the availability of a cache flush instruction in order to cause accesses to DRAM modules at a sufficiently high frequency. We overcome this limitation by defeating complex cache replacement policies. We show that caches can be forced into fast cache eviction to trigger the Rowhammer bug with only regular memory accesses. This allows to trigger the Rowhammer bug in highly restricted and even scripting environments. We demonstrate a fully automated attack that requires nothing but a website with JavaScript to trigger faults on remote hardware. Thereby we can gain unrestricted access to systems of website visitors. We show that the attack works on off-the-shelf systems. Existing countermeasures fail to protect against this new Rowhammer attack. Memory isolation is a key property of a reliable and secure computing system--an access to one memory address should not have unintended side effects on data stored in other addresses. However, as DRAM process technology scales down to smaller dimensions, it becomes more difficult to prevent DRAM cells from electrically interacting with each other. In this paper, we expose the vulnerability of commodity DRAM chips to disturbance errors. By reading from the same address in DRAM, we show that it is possible to corrupt data in nearby addresses. More specifically, activating the same row in DRAM corrupts data in nearby rows. We demonstrate this phenomenon on Intel and AMD systems using a malicious program that generates many DRAM accesses. We induce errors in most DRAM modules (110 out of 129) from three major DRAM manufacturers. From this we conclude that many deployed systems are likely to be at risk. We identify the root cause of disturbance errors as the repeated toggling of a DRAM row's wordline, which stresses inter-cell coupling effects that accelerate charge leakage from nearby rows. We provide an extensive characterization study of disturbance errors and their behavior using an FPGA-based testing platform. Among our key findings, we show that (i) it takes as few as 139K accesses to induce an error and (ii) up to one in every 1.7K cells is susceptible to errors. After examining various potential ways of addressing the problem, we propose a low-overhead solution to prevent the errors Row hammer attacks exploit electrical interactions between neighboring memory cells in high-density dynamic random-access memory (DRAM) to induce memory errors. By rapidly and repeatedly accessing DRAMs with specific patterns, an adversary with limited privilege on the target machine may trigger bit flips in memory regions that he has no permission to access directly. In this paper, we explore row hammer attacks in cross-VM settings, in which a malicious VM exploits bit flips induced by row hammer attacks to crack memory isolation enforced by virtualization. To do so with high fidelity, we develop novel techniques to determine the physical address mapping in DRAMmodules at runtime (to improve the effectiveness of double-sided row hammer attacks), methods to exhaustively hammer a large fraction of physical memory from a guest VM (to collect exploitable vulnerable bits), and innovative approaches to break Xen paravirtualized memory isolation (to access arbitrary physical memory of the shared machine). Our study also suggests that the demonstrated row hammer attacks are applicable in modern public clouds where Xen paravirtualization technology is adopted. This shows that the presented cross-VM row hammer attacks are of practical importance. This paper introduces the new failure mechanism manifested in DDR3 SDRAMs under 3× nm technology. The failure in normal cells is caused by iterative hammering accesses to a row within a refresh cycle. With the valid yet stressful access to a row, the charge in a DRAM cell leaked faster and the values of the stressed cells could not be retained. The three test parameters — t RP , data pattern, and temperature-were varied during the row hammering experiments to understand the contributions of each in triggering and accelerating the failing mechanisms. Here, we mainly discuss the experimental results of the commercial DDR3 components from three major memory vendors. All commercial DDR3 components failed much earlier than the specified limit of allowed accesses. For a vendor memory component, a cell started to fail after only 98K accesses to a row, which is about 7.54 of the specification-permitted accesses of 1,300K Cell splitting frequency reuse is a fundamental characteristic of cellular networks. In macrocellular networks, where pathloss is governed by the distance-to-a-power law, the SINR distribution is invariant to scale, i.e. the spectral efficiency per base (bps Hz base) remains constant, and hence the capacity increases linearly with the density of cells. We show for indoor networks, where signals suffer exponential loss in addition to the inverse square distance law, the median SINR decreases with the density of cells. This results in the capacity being proportional to the square-root of the improvement in the density of cells. Heterogeneous networks using a mix of macrocells and small cells are foreseen as one of the solutions to meet the ever increasing mobile traffic demand. Nevertheless, a massive deployment of small cell access points (SAPs) leads also to a considerable increase in energy consumption. Spurred by growing environmental awareness and the high price of energy, it is crucial to design energy efficient wireless systems for both macrocells and small cells. In this work, we evaluate a distributed sleep-mode strategy for cognitive SAPs and we analyze the trade-off between traffic offloading from the macrocell and the energy consumption of the small cells. Using tools from stochastic geometry, we define the user discovery performance of the SAP and derive the uplink capacity of the small cells located in the Voronoi cell of a macrocell base station, accounting for the uncertainties associated with random position, density, user activity, propagation channel, network interference generated by uncoordinated activity, and the sensing scheme. In addition, we define a fundamental limit on the interference density that allows robust detection and we elucidate the relation between energy efficiency and sensing time using large deviations theory. Through the formulation of several optimization problems, we propose a framework that yields design guidelines for energy efficient small cell networks. DRAMs consume a large portion of total system energy consumption. Thus, reducing DRAM energy consumption is able to prolong the lifetime of battery-operated embedded portable systems. To this end, we propose DRAM energy-aware data prefetching scheme to lengthen DRAM idle periods by clustering DRAM accesses. Low-power modes of DRAMs can better exploit longer idle times. We performed experiments with a cycle-accurate simulator with built-in DRAM power model. The experimental results show that our proposed DRAM-aware prefetching is effective in reducing DRAM energy consumption. Up to 77 and average 59 of DRAM energy consumption is saved. Although cell polarity is an essential feature of living cells, it is far from being well-understood. Using a combination of computational modeling and biological experiments we closely examine an important prototype of cell polarity: the pheromone-induced formation of the yeast polarisome. Focusing on the role of noise and spatial heterogeneity, we develop and investigate two mechanistic spatial models of polarisome formation, one deterministic and the other stochastic, and compare the contrasting predictions of these two models against experimental phenotypes of wild-type and mutant cells. We find that the stochastic model can more robustly reproduce two fundamental characteristics observed in wild-type cells: a highly polarized phenotype via a mechanism that we refer to as spatial stochastic amplification, and the ability of the polarisome to track a moving pheromone input. Moreover, we find that only the stochastic model can simultaneously reproduce these characteristics of the wild-type phenotype and the multi-polarisome phenotype of a deletion mutant of the scaffolding protein Spa2. Significantly, our analysis also demonstrates that higher levels of stochastic noise results in increased robustness of polarization to parameter variation. Furthermore, our work suggests a novel role for a polarisome protein in the stabilization of actin cables. These findings elucidate the intricate role of spatial stochastic effects in cell polarity, giving support to a cellular model where noise and spatial heterogeneity combine to achieve robust biological function. Large-scale blockages such as buildings affect the performance of urban cellular networks, especially at higher frequencies. Unfortunately, such blockage effects are either neglected or characterized by oversimplified models in the analysis of cellular networks. Leveraging concepts from random shape theory, this paper proposes a mathematical framework to model random blockages and analyze their impact on cellular network performance. Random buildings are modeled as a process of rectangles with random sizes and orientations whose centers form a Poisson point process on the plane. The distribution of the number of blockages in a link is proven to be a Poisson random variable with parameter dependent on the length of the link. Our analysis shows that the probability that a link is not intersected by any blockages decays exponentially with the link length. A path loss model that incorporates the blockage effects is also proposed, which matches experimental trends observed in prior work. The model is applied to analyze the performance of cellular networks in urban areas with the presence of buildings, in terms of connectivity, coverage probability, and average rate. Our results show that the base station density should scale superlinearly with the blockage density to maintain the network connectivity. Our analyses also show that while buildings may block the desired signal, they may still have a positive impact on the SIR coverage probability and achievable rate since they can block significantly more interference. Recently, there has been considerable interest in new tiered network cellular architectures, which would likely use many more cell sites than found today. Two major challenges will be i) providing backhaul to all of these cells and ii) finding efficient techniques to leverage higher frequency bands for mobile access and backhaul. This paper proposes the use of outdoor millimeter wave communications for backhaul networking between cells and mobile access within a cell. To overcome the outdoor impairments found in millimeter wave propagation, this paper studies beamforming using large arrays. However, such systems will require narrow beams, increasing sensitivity to movement caused by pole sway and other environmental concerns. To overcome this, we propose an efficient beam alignment technique using adaptive subspace sampling and hierarchical beam codebooks. A wind sway analysis is presented to establish a notion of beam coherence time. This highlights a previously unexplored tradeoff between array size and wind-induced movement. Generally, it is not possible to use larger arrays without risking a corresponding performance loss from wind-induced beam misalignment. The performance of the proposed alignment technique is analyzed and compared with other search and alignment methods. The results show significant performance improvement with reduced search time. For small cell technology to significantly increase the capacity of tower-based cellular networks, mobile users will need to be actively pushed onto the more lightly loaded tiers (corresponding to, e.g., pico and femtocells), even if they offer a lower instantaneous SINR than the macrocell base station (BS). Optimizing a function of the long-term rate for each user requires (in general) a massive utility maximization problem over all the SINRs and BS loads. On the other hand, an actual implementation will likely resort to a simple biasing approach where a BS in tier j is treated as having its SINR multiplied by a factor Aj ≥ 1, which makes it appear more attractive than the heavily-loaded macrocell. This paper bridges the gap between these approaches through several physical relaxations of the network-wide association problem, whose solution is NP hard. We provide a low-complexity distributed algorithm that converges to a near-optimal solution with a theoretical performance guarantee, and we observe that simple per-tier biasing loses surprisingly little, if the bias values Aj are chosen carefully. Numerical results show a large (3.5x) throughput gain for cell-edge users and a 2x rate gain for median users relative to a maximizing received power association. Die-stacking technology enables multiple layers of DRAM to be integrated with multicore processors. A promising use of stacked DRAM is as a cache, since its capacity is insufficient to be all of main memory (for all but some embedded systems). However, a 1GB DRAM cache with 64-byte blocks requires 96MB of tag storage. Placing these tags on-chip is impractical (larger than on-chip L3s) while putting them in DRAM is slow (two full DRAM accesses for tag and data). Larger blocks and sub-blocking are possible, but less robust due to fragmentation. This work efficiently enables conventional block sizes for very large die-stacked DRAM caches with two innovations. First, we make hits faster than just storing tags in stacked DRAM by scheduling the tag and data accesses as a compound access so the data access is always a row buffer hit. Second, we make misses faster with a MissMap that eschews stacked-DRAM access on all misses. Like extreme sub-blocking, our implementation of the MissMap stores a vector of block-valid bits for each "page" in the DRAM cache. Unlike conventional sub-blocking, the MissMap (a) points to many more pages than can be stored in the DRAM cache (making the effects of fragmentation rare) and (b) does not point to the "way" that holds a block (but defers to the off-chip tags). For the evaluated large-footprint commercial workloads, the proposed cache organization delivers 92.9 of the performance benefit of an ideal 1GB DRAM cache with an impractical 96MB on-chip SRAM tag array. Contrary to widespread assumption, dynamic RAM (DRAM), the main memory in most modern computers, retains its contents for several seconds after power is lost, even at room temperature and even if removed from a motherboard. Although DRAM becomes less reliable when it is not refreshed, it is not immediately erased, and its contents persist sufficiently for malicious (or forensic) acquisition of usable full-system memory images. We show that this phenomenon limits the ability of an operating system to protect cryptographic key material from an attacker with physical access to a machine. It poses a particular threat to laptop users who rely on disk encryption: we demonstrate that it could be used to compromise several popular disk encryption products without the need for any special devices or materials. We experimentally characterize the extent and predictability of memory retention and report that remanence times can be increased dramatically with simple cooling techniques. We offer new algorithms for finding cryptographic keys in memory images and for correcting errors caused by bit decay. Though we discuss several strategies for mitigating these risks, we know of no simple remedy that would eliminate them. This work efficiently enables conventional block sizes for very large die-stacked DRAM caches with two innovations: it makes hits faster with compound-access scheduling and misses faster with a MissMap. The combination of these mechanisms enables the new organization to deliver performance comparable to that of an idealistic DRAM cache that employs an impractically large SRAM-based on-chip tag array. Energy efficiency (EE) is becoming an important design goal for wireless communication systems providing high spectral efficiency (SE). Both massive multi-input multi-output (MIMO) and small cell network (SCN) are expected to achieve high EE for high throughput cellular networks, though using different mechanisms. Massive MIMO improves EE by exploiting a large array gain, while SCN improves EE by deploying a large number of low-power base stations (BSs) to reduce the propagation loss and increase the opportunity of BS sleep. In this paper, we compare the EEs as well as the SEs of Massive MIMO and SCN. For a fair comparison, we consider a multi-cell network with the same user density, antenna density and average cell-edge signal-to-noise-ratio (SNR). Perfect channel information is assumed, and three BS sleep strategies are considered. Our analysis shows that the EE of SCN increases with the cell size shrinking, and the achievable SEs of SCN and Massive MIMO increase with the cell-edge SNR. When the number of cells is large, SCN is always more energy efficient than Massive MIMO. On the other hand, when the number of cells is small, Massive MIMO achieves higher EE than SCN when the circuit power consumptions of Massive MIMO are much lower than SCN. Random spatial models are attractive for modeling heterogeneous cellular networks (HCNs) due to their realism, tractability, and scalability. A major limitation of such models to date in the context of HCNs is the neglect of network traffic and load: all base stations (BSs) have typically been assumed to always be transmitting. Small cells in particular will have a lighter load than macrocells, and so their contribution to the network interference may be significantly overstated in a fully loaded model. This paper incorporates a flexible notion of BS load by introducing a new idea of conditionally thinning the interference field. For a K-tier HCN where BSs across tiers differ in terms of transmit power, supported data rate, deployment density, and now load, we derive the coverage probability for a typical mobile, which connects to the strongest BS signal. Conditioned on this connection, the interfering BSs of the i^ th tier are assumed to transmit independently with probability p_i, which models the load. Assuming — reasonably — that smaller cells are more lightly loaded than macrocells, the analysis shows that adding such access points to the network always increases the coverage probability. We also observe that fully loaded models are quite pessimistic in terms of coverage. Blocking objects (blockages) between a transmitter and receiver cause wireless communication links to transition from line-of-sight (LOS) to non-LOS propagation, which can greatly reduce the received power, particularly at the higher frequencies such as millimeter wave. We consider a cellular network in which a mobile user attempts to connect to two or more base stations (BSs) simultaneously, to increase the probability of at least one LOS link, which is a form of macrodiversity. We develop a framework for determining the LOS probability as a function of the number of BSs, when taking into account the correlation between blockages: for example, a single blockage close to the device—including the user’s own body—could block multiple BSs. We consider the impact of the size of blocking objects on the system’s @math th order LOS probability and show that macrodiversity gains are higher when the blocking objects are small. We also show that the BS density must scale as the square of the blockage density to maintain a given level of LOS probability. Many crucial biological processes operate with surprisingly small numbers of molecules, and there is renewed interest in analyzing the impact of noise associated with these small numbers. Twenty-five years ago, Berg and Purcell showed that bacterial chemotaxis, where a single-celled organism must respond to small changes in concentration of chemicals outside the cell, is limited directly by molecule counting noise and that aspects of the bacteria's behavioral and computational strategies must be chosen to minimize the effects of this noise. Here, we revisit and generalize their arguments to estimate the physical limits to signaling processes within the cell and argue that recent experiments are consistent with performance approaching these limits. Reducing the energy consumption of a wireless cellular network is an important and urgent problem. This paper studies the effect of cell sizes on the energy consumed by the network, assuming base station technologies of today and the future. Making cell sizes too small or too large can significantly increase energy consumption. We show that the optimal cell size from an energy perspective depends on a number of factors, including base station technology, data rates, and traffic demands. Given that traffic varies significantly during a day, dynamically adjusting cell sizes can help reduce energy consumption. We propose a practical, 2-level scheme that adjusts cell sizes between two fixed values, and show an energy saving of up to 40 . The paper also proposes some self-organizing techniques to allow this dynamic cell size adjustment.