CHES 2002 Presented at the workshop CHES 2002, August 13-15, 2002, Redwood Shores, California, USA.
Data remanence in Flash Memory Devicessps32/Slides_CHES2005.pdf · 9 CHES 2005 Workshop Edinburgh,...
Transcript of Data remanence in Flash Memory Devicessps32/Slides_CHES2005.pdf · 9 CHES 2005 Workshop Edinburgh,...
1
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Data remanencein Flash Memory Devices
Sergei Skorobogatov
2
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Data remanence
�Residual representation of data after erasure�Magnetic media�SRAM and DRAM
�Low-temperature data remanence�Long-term retention effects
�EEPROM and Flash�Should be possible�No information available�Independent testing was performed
3
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Non-volatile memories
� EEPROM and Flash�Widely used in microcontrollers and smartcards�Advantages
� Electrically programmable and erasable� Internal charge pumps (no external high voltages necessary)� High endurance (>100,000 E/W cycles)� Long data retention (>40 years)
�Disadvantages� Larger cell size than Mask ROM� Flash erased in blocks� Longer write/erase time than SRAM
4
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Structure of non-volatile memories
� UV EPROM EEPROM Flash EEPROM
5
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Data remanence in non-volatile memories
� EPROM, EEPROM and Flash� Floating-gate transistors, 103 – 105 e-, �VTH = 3 …4 V
� Levels of remanence threat� File system (erasing a file � undelete)� File backup (software features)�Smart memory (hardware buffers)�Memory cell
� Possible outcomes�Circumvention of microcontroller or smartcard security� Information leakage through shared EEPROM areas
between different applications in smartcards
6
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Attacks on EPROM/EEPROM devices
� Erase with UV light followed by power glitching�Memory and password/fuse are erased simultaneously
�VDD variation or power glitching�Read sense circuit: VTH = K VDD, K ~ 0.5
�Not suitable for 0.35 �m and smaller technologiesUV Erase of PIC12C509 (old revis ion)
0
1
2
3
4
5
6
7
0 2 4 6 8 10 12 14
Tim e, m in
VD
D, V
EPROM OK EPROM erased Fuse erased
7
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Attacks on EEPROM/Flash devices
� Electrical erase� Memory and password are erased simultaneously
� Fast process (difficult to control erasure)� VTH drops too low (power glitching does not work)� Cell charge alteration does not work
� Voltage monitors and internally stabilized power supply� Internal charge pumps and timing control� Difficult to terminate the erase/programming cycle
Electrical Erase of MSP430F112
0
0.5
1
1.5
2
2.5
3
3.5
4
4.5
0 200 400 600 800 1000 1200 1400 1600
Time, us
VD
D, V
FLASH OK FLASH erased
8
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Experimental part
� Is it possible to measure a VTH close to 0 V?� Is any significant residual charge left after a
normal erase operation?� Is it possible to distinguish between never-
programmed and programmed cells?� Countermeasures?
9
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Experimental part
� Data remanence evaluation in PIC16F84A� 100 �V precision power supply� 1 �s timing control
10
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Measuring VTH close to 0 V in PIC16F84A
� Power glitch to reduce Vref to 0.5 V� Exploiting after-erase discharging delay
�Accidentally discovered 5 years ago�Shifts VTH up by 0.6 – 0.9 V
� Apply both techniques simultaneously:�VTH = K VDD – VW
�VTH = −0.4 …2.0 V
11
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Test residual charge after erase
� VTH = Vref = K VDD – VW, K = 0.5, VW = 0.7 V� Memory bulk erase cycles (5 V, 10 ms)
� Flash memory, 100 cycles: �VTH = 100 mV� EEPROM memory, 10 cycles: �VTH = 1 mV
Threshold Voltage Change During Erase Cycles
0
0.1
0.2
0.3
0.4
0.5
0.6
0 100 200 300 400 500 600
Number of Erase Cycles
VT
H, V
Programmed Fully erased
12
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Recovering data from erased PIC16F84A
� Large difference in VTH between cells in the array� Measure the cell’s VTH before and after an extra erase cycle
Threshold Voltage Distribution
0.35
0.4
0.45
0.5
0.55
0.6
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
Memory Address
VT
H, V
First erase Second erase
13
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Never-programmed and programmed cells
� PIC16F84A comes programmed to all 0’s� 10,000 erase cycles to fully discharge cells. Measure VTH
� Program to all 0’s, then another 10,000 erase cycles. Measure VTH
� Still noticeable change of �VTH = 40 mV
Threshold Voltage Distribution
-0.1
-0.05
0
0.05
0.1
0.15
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
Memory Address
VT
H, V
Programmed and erased Never programmed
14
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Programming cells before erasure
� Cannot successfully recover information from PIC16F84A if it was programmed to all 0’s before the erase operation
� This is a standard procedure in some Flash and EEPROM devices:� Intel ETOX Flash memory (P28F010)�Microchip KeeLoq HCS200
� Not used in modern EEPROM/Flash memory devices
15
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Other ways of data remanence testing
�Semi-invasive approach (access to passivation layer)�Measure changes inside memory transistors� Influence on cell characteristics (VTH)� Influence on read-sense circuit (Vref)
� Invasive approach (access through passivation layer)�Modify the read-sense circuit of the memory�Direct connection to internal memory lines
16
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Semi-invasive testing
Test setup Focusing the laser (100x objective)
17
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Semi-invasive testing
� Images of the PIC16F84A EEPROM (0.9 �m, 2M)� Change Vref = f(PL) to measure VTH
Optical
Laser scanned (OBIC)
18
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Semi-invasive testing
Images of the ATmega8 EEPROM (0.35 �m, 3M)
Optical
Optical after
depro-cessing
Laser scanned (OBIC)
19
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Semi-invasive testing
� Focus a laser on the ATmega8 die using a 100x objective in order to change Vref
� Less successful (<10% after one erase cycle) due to multiple metal layers and polished insulation layers
20
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Countermeasures
� Cycle EEPROM/Flash 10 – 100 times with new random data before writing sensitive information to them
� Program (charge) all EEPROM/Flash cells before erasing them� Remember about “intelligent” memories, backup and temporary
files in file systems� Remember that memory devices are identical within the same
family:� everything which is valid for PIC16F84A will work for PIC16F627/628,
PIC16F870/871/872 and PIC16F873/874/876/877
� Use latest high-density devices, as smaller scales make semi-invasive attacks less feasible
� Cryptography can help to make data recovery more difficult. E.g. store longer pre-key R instead of key: K=h(R)
21
CHES 2005 Workshop Edinburgh, UK, 29 August – 01 September 2005
Conclusions
� Floating-gate memories (EPROM, EEPROM and Flash) have data-remanence problems
� Information from some samples can be recovered even after 100 erase cycles
� Even where the residual charge cannot yet be detected with existing methods, future technologies may permit this
� Secure devices should be tested for data-remanence effects