KR20220090409A - Memory system and operation method of memory system - Google Patents

Abstract

The memory system includes: an address scrambler that scrambles an address according to a scrambling rule to generate a scrambled address; a memory core including a plurality of memory cells and storing data in the memory cells designated by the scramble address; and a scrambling control circuit configured to change the scrambling rule in response to satisfaction of an attack condition.

Description

MEMORY SYSTEM AND OPERATION METHOD OF MEMORY SYSTEM

This patent document relates to a memory system.

As the density of the memory increases, the spacing between a plurality of word lines included in the memory is decreasing. As the spacing between word lines decreases, a coupling effect between adjacent word lines increases.

Meanwhile, whenever data is input/output to/from the memory cell, the word line toggles between an active (active) state and an inactive state. There is a phenomenon in which data in the memory cell connected to the is damaged. This phenomenon is called row hammering, and data in the memory cell is damaged before the memory cell is refreshed due to word line disturbance, which is a problem.

1 is a diagram for explaining row hammering, and is a diagram illustrating a part of a cell array included in a memory.

In FIG. 1, 'WLL' corresponds to a word line (row line) with a large number of activations, and 'WLL-1' and 'WLL+1' are word lines disposed adjacent to 'WLL', that is, the number of activations, respectively. corresponds to a word line adjacent to the word line. In addition, 'CL' denotes a memory cell connected to 'WLL', 'CL-1' denotes a memory cell connected to 'WLL-1', and 'CL+1' denotes a memory cell connected to 'WLL+1'. Each memory cell includes cell transistors TL, TL-1, and TL+1 and cell capacitors CAPL, CAPL-1, and CAPL+1.

In FIG. 1, when 'WLL' is activated or deactivated, the voltages of 'WLL-1' and 'WLL+1' increase due to a coupling phenomenon occurring between 'WLL' and 'WLL-1' and 'WLL+1'. It also affects the amount of charge in the cell capacitors CL-1 and CL+1 as it goes down. Therefore, when the activation of 'WLL' occurs frequently and the 'WLL' toggles between the active state and the inactive state, the cell capacitors (CAPL-1, CAPL+1) included in 'CL-1' and 'CL+1' A change in the amount of stored charge may increase and data in the memory cell may deteriorate.

In addition, electromagnetic waves generated while the word line toggles the active state and the inactive state cause data to be damaged by introducing electrons into or outflowing electrons from the cell capacitor of the memory cell connected to the adjacent word line.

As a method for solving row hammering, a method of finding a row (word line) that has been activated several times and refreshing adjacent rows of a row that has been activated multiple times is mainly used.

According to the embodiments of the present invention, it is possible to provide a technique for increasing the low hammering attack defense capability of the memory system.

According to an embodiment of the present invention, there is provided a memory system, comprising: an address scrambler generating a scrambled address by scrambling an address according to a scrambling rule; a memory core including a plurality of memory cells and storing data in the memory cells designated by the scramble address; and a scrambling control circuit configured to change the scrambling rule in response to satisfaction of an attack condition.

According to an embodiment of the present invention, a method of operating a memory system includes: scrambling an address according to a first scrambling rule; accessing a memory core using an address scrambled according to the first scrambling rule; confirming that the attack condition for the memory core is satisfied; changing the first scramble rule to a second scramble rule; scrambling an address according to the second scrambling rule; and accessing the memory core using an address scrambled according to the second scrambling rule.

According to the embodiments of the present invention, it is possible to increase the defense capability of the memory system against the row hammering attack.

1 is a view for explaining row hammering.
2 is a block diagram of a memory system 200 according to an embodiment of the present invention.
3 is a block diagram of a memory system 300 according to another embodiment of the present invention.
4 is a flowchart illustrating an operation of the memory system 200 of FIG. 2 .

Hereinafter, the most preferred embodiment of the present invention will be described with reference to the accompanying drawings in order to describe in detail so that those of ordinary skill in the art to which the present invention pertains can easily implement the technical idea of the present invention. In describing the present invention, well-known components that are not related to the gist of the present invention may be omitted. In adding reference numbers to the components of each drawing, it should be noted that only the same components are given the same number as possible even though they are indicated on different drawings.

2 is a block diagram of a memory system 200 according to an embodiment of the present invention.

Referring to FIG. 2 , the memory system 200 may include a memory controller 210 and a memory 250 .

The memory controller 210 may control the operation of the memory 250 according to a request from the host HOST. The host may include a central processing unit (CPU), a graphic processing unit (GPU), an application processor (AP), and the like. The memory controller 210 includes a host interface 211 , a scheduler 213 , a command generator 215 , a row hammer attack pattern detection circuit 217 , an error correction circuit 219 , a scramble control circuit 221 , an address scrambler ( 223 ) and a memory interface 225 . The memory controller 210 may be included in a CPU, GPU, AP, etc. In this case, the host may mean a configuration other than the memory controller 210 in these configurations. For example, when the memory controller 210 is included in the CPU, the host (HOST) of the figure may represent the remaining components in the CPU except for the memory controller 210 .

The host interface 211 may be for an interface between the memory controller 210 and the host HOST.

The scheduler 213 may determine the order of requests to be indicated to the memory 250 among requests from the host HOST. In order to improve the performance of the memory 250 , the scheduler 213 may change the order in which requests are received from the host HOST and the order of operations to be directed to the memory 250 . For example, even if the host HOST requests the read operation of the memory 250 first and then requests the write operation, the order may be adjusted so that the write operation is performed before the read operation.

The command generator 215 may generate a command to be applied to the memory 250 according to the order of operations determined by the scheduler 213 .

The raw hammer attack pattern detection circuit 217 may detect a raw hammer attack pattern with respect to the memory core 251 of the memory 250 . The row hammer attack pattern detection circuit 217 counts the number of active operations of rows of the memory core 251, and hammers a row with a high probability of data loss for an excessively active row It can be classified as a hammered row. Since the rows adjacent to the hammered row in the memory core 251 have a high risk of data loss, the scheduler 213 performs a refresh operation on the rows adjacent to the hammered row, and this refresh operation is also called a smart refresh operation. can be scheduled.

The error correction circuit 219 may detect and correct errors in data stored in the memory 250 . The error correction circuit 219 may generate an error correction code (ECC) using data to be written to the memory 250 during a write operation of the memory 250 . The error correction code generated by the error correction circuit 219 may be stored in the memory 250 together with the write data. The error correction circuit 219 detects an error in data read from the memory 250 using the error correction code read from the memory 250 during a read operation of the memory 250 , and when an error is found This can be corrected in

The address scrambler 223 may scramble the address according to a predetermined scrambling rule to generate a scrambled address. The memory 250 may be accessed by the scramble address generated by the address scrambler 223 .

The scramble control circuit 221 may change the scrambling rule of the address scrambler 223 whenever an attack condition is satisfied. Here, the satisfaction of the attack condition may mean checking a condition under which it can be determined that there is a hacker's low hammer attack. Whether the attack condition is satisfied may be checked using the raw hammer attack pattern detection circuit 217 and the error correction circuit 219 . For example, when the following conditions (1) and (2) are satisfied, it may be determined that the attack condition is satisfied.

(1) Low hammer attack pattern detection for one row by the row hammer attack pattern detection circuit 217 . For example, if any one row is selected as a hammered row by being active too many times, it may be determined that a row hammer attack pattern for the corresponding row is detected.

(2) An error greater than or equal to the threshold value is found from adjacent rows of the hammered row by the error correction circuit 219 . That is, if an error greater than a threshold value is found when a read operation is performed from adjacent rows of a hammered row, it can be determined that the hacker's row hammer attack is somewhat successful and the attack condition is satisfied.

In the case of a raw hammer attack, the hacker performs a raw hammer attack on the kernel, that is, important security information, and this memory area, distorting data and taking away the authority of the computer system. Since the hacker does not know the location where the kernel is stored in the memory 250 , the hacker finds out where the kernel is by going through trial and error to attack various areas through the low hammer attack. Whenever the scramble control circuit 221 detects a hacker attack condition, it changes the scrambling rule of the address scrambler 223 so that it may be impossible for the hacker to find out the location where the kernel is stored. In other words, it is possible to effectively defend against a hacker's low hammer attack.

The memory interface 225 may be for an interface between the memory controller 210 and the memory 250 . A command and an address CA may be transmitted from the memory controller 210 to the memory 250 through the memory interface 225 , and data DATA may be transmitted/received. The memory interface 221 is also referred to as a PHY interface.

The memory 250 may perform an operation indicated by the memory controller 210 . The memory 250 may be a memory requiring a refresh operation. For example, the memory 250 may be a DRAM or another type of memory requiring a refresh operation.

The memory 250 may include a memory core 251 , a control circuit 253 , and an e-fuse array circuit 255 .

The control circuit 253 may control the overall operation of the memory 250 . The control circuit 253 performs operations indicated by a command and an address CA, for example, an active operation, a precharge operation, a read operation, a write operation, and a refresh operation. ), the internal components of the memory 250 can be controlled so that the memory 250 can perform the operation.

The memory core 251 may include a plurality of memory cells arranged in a plurality of rows and a plurality of columns. Also, the memory core 251 may include circuits for writing data to and reading data from the memory cells.

The e-fuse array circuit 255 includes a plurality of e-fuses, and may store information related to repair of the memory 250 and information related to various settings of the memory 250 . Information stored in the e-fuse array circuit 255 may be continuously maintained even when the power of the memory 250 is turned off. The scramble control circuit 221 may store information related to a scrambling rule used by the address scrambler 223 in the e-fuse array circuit 255 in case the memory system 200 is powered off.

3 is a block diagram of a memory system 300 according to another embodiment of the present invention.

Referring to FIG. 3 , the memory system 300 may include a memory controller 310 and a memory 350 .

The memory controller 310 includes a host interface 311 , a scheduler 313 , a command generator 315 , a low hammer attack pattern detection circuit 317 , an error correction circuit 319 , a scramble control circuit 321 , and a memory interface ( 325) may be included. Configurations 311 , 313 , 315 , 317 , 319 , 321 , and 325 of the memory controller 310 of FIG. 3 are the configurations 211 , 213 , 215 , 217 , 219 , 221 of the memory controller 210 of FIG. 2 . , 225) can be designed in the same way.

The memory controller 310 has a configuration in which the address scrambler 223 is omitted compared to the memory controller 210 . This is because, in the embodiment of FIG. 3 , the address scrambler 323 is included in the memory 350 rather than the memory controller 310 . The memory controller 310 transmits an unscrambled address to the memory 350 through the memory interface 225 , and the address scrambling operation may be performed by the address scrambler 323 of the memory 350 . The scramble control circuit 321 may change the scrambling rule of the address scrambler 323 of the memory 350 through the memory interface 325 .

The memory 350 may include a memory core 351 , a control circuit 353 , an e-fuse array circuit 355 , and an address scrambler 323 . Configurations 351 , 353 , and 355 of the memory 350 of FIG. 3 may be designed the same as configurations 251 , 353 , and 355 of the memory 250 of FIG. 2 .

The address scrambler 323 of the memory 350 may scramble the address transmitted from the memory controller 310 , and the address scrambled by the address scrambler 323 may be used to access the memory core 351 .

Unlike the memory system 200 of FIG. 2 , the memory system 300 of FIG. 3 includes an address scrambler 323 in the memory 350 . As such, the components of the memory system 300 may be included in any one of the memory controller 310 and the memory 350 . For example, some or all of the raw hammer attack pattern detection circuit 317 , the error correction circuit 319 , and the scrambling control circuit 321 may be included in the memory 350 instead of the memory controller 310 .

4 is a flowchart illustrating an operation of the memory system 200 of FIG. 2 . The memory system 300 of FIG. 3 may operate in the same manner as in FIG. 4 .

Referring to FIG. 4 , first, the memory core 251 may be accessed using an address scrambled according to the first scrambling rule ( 401 ). When the memory controller 210 accesses the memory 250 , the address scrambler 223 scrambles the address according to the first scrambling rule, and the scrambled address is transferred to the memory 250 so that the memory core 251 can be accessed. have.

During the operation of the memory system 200 , an attack condition for the memory core 251 may be satisfied (Y in 403 ). Satisfaction of the attack condition may be determined by the fact that any one row is selected as a hammered row by being activated too many times, and an error greater than or equal to a threshold value is found from adjacent rows of the hammered row. The scramble control circuit 221 may determine to change the scrambling rule of the address scrambler 223 in response to the attack condition being satisfied.

After the attack condition is satisfied, the data of the memory core 251 may be backed up ( 405 ). When the scrambling rule of the address scrambler 223 is changed, the address mapping of the memory core 251 is changed, and thus data of the memory core 251 is backed up. The memory controller 210 may transmit an interrupt signal to the host HOST before backing up data of the memory core 251 to temporarily stop the operation of the host HOST. Data of the memory core 251 may be backed up in another memory (not shown) or storage in the memory system 200 .

After the backup is completed, the scrambling control circuit 221 may change the scrambling rule of the address scrambler 223 from the first scrambling rule to a second scrambling rule different from the first scrambling rule ( 407 ). If the scramble rule is changed, it may become very difficult for a hacker to track an area in the memory core 251 where sensitive security data is stored. Address scrambling may be performed using a pseudo random binary sequence (PRBS). Between the first scrambling rule and the second scrambling rule, in the process of scrambling an address using the PRBS, the order of the scrambled address bits and the PRBS may be different from each other. have.

After the scrambling rule is changed, the backed up data may be restored back to the memory core 251 ( 409 ).

In addition, the memory core 251 may be accessed using the scrambled address according to the second scrambling rule ( 411 ). When the memory controller 210 accesses the memory 250, the address scrambler 233 scrambles the address according to the second scrambling rule, and the scrambled address is transmitted to the memory 250 so that the memory core 251 can be accessed. have. Also, the scrambling control circuit 221 may store information related to the changed scrambling rule in the e-fuse array circuit 255 of the memory 250 .

4 illustrates that data of the memory core 251 is backed up before the scrambling rule is changed, and data of the memory core 251 is restored after the scrambling rule is changed. However, if data written before the change of the scrambling rule and data written after the change of the scrambling rule can be traced, access to the data stored using the previous scrambling rule may be possible even if the scrambling rule is changed. This may be omitted.

Although the technical idea of the present invention has been specifically described according to the above preferred embodiment, it should be noted that the above-described embodiment is for the purpose of explanation and not for limitation thereof. In addition, an expert in the technical field of the present invention will know that various embodiments are possible within the scope of the technical idea of the present invention.

200: memory system
210: memory controller
250: memory
211: host interface
213: scheduler
215: command generator
217: low hammer attack pattern detection circuit
219: error correction circuit
221: scramble control circuit
223: address scrambler
225: memory interface

Claims (13)

an address scrambler that scrambles an address according to a scrambling rule to generate a scrambled address;
a memory core including a plurality of memory cells and storing data in the memory cells designated by the scramble address; and
A scramble control circuit for changing the scrambling rule in response to the satisfaction of an attack condition
A memory system comprising a.
The method of claim 1,
a low hammer attack pattern detection circuit for detecting a low hammer attack pattern with respect to the memory core; and
An error correction circuit for detecting and correcting an error in data read from the memory core
A memory system further comprising a.
3. The method of claim 2,
The scramble control circuit is
A low hammer attack pattern for one of the rows of the memory core is detected by the row hammer attack pattern detection circuit, and an error greater than or equal to a threshold is detected in adjacent rows of the one row by the error correction circuit If it is determined that the above attack condition is satisfied
memory system.
3. The method of claim 2,
The memory system further comprises an e-fuse array circuit,
The scrambling control circuit stores information related to the scrambling rule in the e-fuse array circuit.
memory system.
3. The method of claim 2,
the address scrambler, the scramble control circuit, the row hammer attack pattern detection circuit, and the error correction circuit are included in a memory controller;
wherein the memory core and the e-fuse array circuit are included in a memory.
memory system.
3. The method of claim 2,
the scramble control circuit, the low hammer attack pattern detection circuit, and the error correction circuit are included in a memory controller;
wherein the address scrambler, the memory core, and the e-fuse array circuit are included in a memory.
memory system.
The method of claim 1,
When the change of the scrambling rule is determined by the scrambling control circuit,
The data of the memory core is backed up,
After the completion of the backup, the scrambling rule is changed,
Data backed up after the change of the scrambling rule is restored to the memory core
memory system.
scrambling the address according to the first scrambling rule;
accessing a memory core using an address scrambled according to the first scrambling rule;
confirming that the attack condition for the memory core is satisfied;
changing the first scramble rule to a second scramble rule;
scrambling an address according to the second scrambling rule; and
accessing the memory core using an address scrambled according to the second scrambling rule;
A method of operating a memory system comprising a.
9. The method of claim 8,
The step in which the satisfaction of the attack condition is confirmed
confirming detection of a row hammer attack pattern for one row of the memory core; and
and confirming that an error greater than or equal to a threshold value has occurred in adjacent rows of the one row.
How the memory system works.
9. The method of claim 8,
Before changing the first scramble rule to the second scramble rule,
Backing up the data of the memory core
Method of operation of a memory system further comprising a.
11. The method of claim 10,
After changing the first scramble rule to the second scramble rule,
Restoring the backed up data to the memory core
Method of operation of a memory system further comprising a.
9. The method of claim 8,
The scrambling of the address according to the first scrambling rule, the confirming, the changing, and the scrambling of the address according to the first scrambling rule are performed by a memory controller;
The step of accessing the memory core using the address scrambled according to the first scrambling rule and the step of accessing the memory core using the address scrambled according to the first scrambling rule are performed by the memory.
How the memory system works.
9. The method of claim 8,
The confirming step and the changing step are performed by a memory controller,
Scrambling an address according to the first scrambling rule, scrambling an address according to the second scrambling rule, accessing a memory core using an address scrambled according to the first scrambling rule, and the first scrambling rule The step of accessing the memory core using the scrambled address according to the
How the memory system works.

Images