GANGRENE: Exploring the Mortality of Flash Memory

Transcription

1 GANGRENE: Exploring the Mortality of Flash Memory Naval Surface Warfare Center, Crane Division Indiana University Apu Kapadia Indiana University

2 Flash memory is ubiquitous zes/l/in/photostream/ PanamaG_Playstation_3.svg.hi.png 2

3 Flash memory is ubiquitous zes/l/in/photostream/ PanamaG_Playstation_3.svg.hi.png 3

4 Flash memory is fast, rugged, and cheap SEEK TIME Air pressure 4

5 but flash memory has a weakness NAND gate finite write endurance oxide - trapped charge Endurance Architecture (PE cycles) SLC ~100,000 MLC ~10,000 TLC <1,000 depletable storage both capacity and write endurance are limited constraints, Prabhakaran (HOTSTORAGE 2010) 5

6 Various strategies are used to increase flash endurance wear-leveling 0 deduplication error correction codes 6

7 Flash controllers employ these strategies and manage flash flash controller RAM algorithms (WL, GC, compression, dedup, etc) USB/SAS/SATA interface flash translation layer (FTL) to flash IC 7

8 Flash memory is generally tested under normal use vs m5lp_1001_2009_mustang_week/ w200/m5lp _1001_10_+2009_mustang_week+drifting.jpg READ WRITE 8

9 GANGRENE seeks to induce premature death of flash Goals: maximally accelerate wear attack with no a priori knowledge passively evade detection 9

10 What is the meaning of LIFE? device life expressed in GB written published device capacity in GB max rated PE cycles (vendor provided) acceleration factor ( is reduced for A > 1) 10

11 What is the meaning of LIFE? Example 2GB device with endurance rating of 3,000 device cycles life dies expressed after 600 in GB GB written are written: published device capacity in GB nominal WE cycles acceleration factor ( is reduced for A < 1) This device experienced a 10x Example calculation(s) acceleration in degradation 11

12 We implemented GANGRENE GANGRENE in C maximize write activity vary file size vary file contents log and monitor throughput wait 12

13 For our random protocol we observed a mean acceleration of Drive # C (GB) E max LIFE (GB) A 1 2 3, , , , , = These drives failed in days = 7.71 These results are out of the box (no tuning) 13

14 For our test drives we observed a mean acceleration of Drive # LIFE (GB) C (GB) E max A , , no failures from the deterministic , protocol drives after 6 months! , , still going 14

15 What is death like? denial to write failure may preserve existing data failure is not always permanent failure occurs with no warning 15

16 What about other flash devices? easy 16

17 What about other flash devices? easy 17

18 What about other flash devices? easy 18

19 Can GANGRENE do better? we still know very little about flash vulnerability can be increased? more testing is necessary 19

20 How can we defend against GANGRENE? host system application operating system flash device flash memory IC flash controller IC driver interface 20

21 How can we defend against GANGRENE? host system application operating system driver interface flash device flash memory IC flash controller IC monitor I/O use display detect 21

22 How can we defend against GANGRENE? host system application operating system driver interface flash device flash memory IC flash controller IC visibility of wear fine-grained write control 22

23 How can we defend against GANGRENE? host system application operating system driver interface flash device flash memory IC flash controller IC don t be write promiscuous 23

24 More work is needed to bolster flash devices against malicious use we rely on many devices that use flash memory our results show that failure occurs completely and without warning are SSDs and mobile devices vulnerable to GANGRENE? 24