SecDDR：通过保护DDR接口实现低成本安全内存
SecDDR: Enabling Low-Cost Secure Memories by Protecting the DDR Interface
AI总结：
SecDDR面向DDRx直接连接内存提出低成本重放攻击保护方案，通过在ECC芯片DRAM裸片上放置有限安全逻辑，避免内存侧数据认证且不改变DDR协议，实现接近仅加密内存的性能并显著优于完整性树和认证通道。
摘要：
云提供商和用户的安全目标包括内存机密性和完整性，这需要实现重放攻击保护（RAP）。RAP可以通过完整性树或相互认证通道来实现。完整性树会带来显著的性能开销，并且对于保护大容量内存而言不切实际。相互认证通道仅针对分组化内存接口提出，这类接口只覆盖非常小的细分领域，并且需要对内存系统架构进行根本性改变。我们提出SecDDR，这是一种面向直接连接内存（如DDRx）的低成本RAP。SecDDR避免了内存侧数据认证，因此仅向内存组件添加少量逻辑，并且不改变底层DDR协议，使其具备广泛采用的实用性。与先前需要信任整个内存模块的相互认证方案不同，SecDDR通过将其有限的安全逻辑放置在ECC芯片的DRAM裸片（或封装）上，面向不可信模块。我们的评估表明，SecDDR的性能在无RAP的仅加密内存的1%以内，并且相对于64叉完整性树和认证通道，SecDDR分别提供了18.8%和7.8%的平均性能提升（最高可达190.4%和24.8%）。
英文摘要：
The security goals of cloud providers and users include memory confidentiality and integrity, which requires implementing Replay-Attack protection (RAP). RAP can be achieved using integrity trees or mutually authenticated channels. Integrity trees incur significant performance overheads and are impractical for protecting large memories. Mutually authenticated channels have been proposed only for packetized memory interfaces that address only a very small niche domain and require fundamental changes to memory system architecture. We propose SecDDR, a low-cost RAP that targets direct-attached memories, like DDRx. SecDDR avoids memory-side data authentication, and thus, only adds a small amount of logic to memory components and does not change the underlying DDR protocol, making it practical for widespread adoption. In contrast to prior mutual authentication proposals, which require trusting the entire memory module, SecDDR targets untrusted modules by placing its limited security logic on the DRAM die (or package) of the ECC chip. Our evaluation shows that SecDDR performs within 1% of an encryption-only memory without RAP and that SecDDR provides 18.8% and 7.8% average performance improvements (up to 190.4% and 24.8%) relative to a 64-ary integrity tree and an authenticated channel, respectively.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
