Aging-Induced Long-Term Data Remanence in SRAM Cells

Abstract

Within the electronics industry, data recovery has been a primary focus of security experts and researches for decades. The vast majority of this research has been performed and realized in the form of hard disk recovery, covering various types of non-volatile memories. In contrast, almost none of this research has considered data recovery from volatile memories. This is because one of volatile memory's innate properties is that the data is lost upon loss of power, leading to the wide assumption that recovering data is impossible. This research discusses the inaccuracies of this assumption, and presents an approach to recovering data from static random access memory, commonly known as SRAM. This conventional wisdom leads to designers not being required to protect sensitive information, such as firmware or secret encryption keys, when the system is retired. Unfortunately, the recycling of these parts means that either intellectual property or security could be compromised, should the data be successfully reconstructed. This thesis presents a novel concept to retrieve previously stored SRAM data, as the aging of SRAM leads to a power-up state with an imprint of the stored values. It then shows that the proposed approaches can partially recover the original SRAM content.

The accuracy and volume of recovered data can be further increased by incorporating multiple chips instead of a single one, as it might be impossible to retrieve data from some cells. Some stable cells in each chip will be moved further towards stability, making a change impossible to detect. However, chip-to-chip process variation means that the change might be detectable in a different, identical chip. After analyzing the power-up states of all cells in all chips, a majority voting algorithm is used to combine the set into the recovered data. This paper presents the experimental results using off-the-shelf SRAM chips, loaded with a binary image and subjected to accelerated aging. It demonstrates the partial recovery of data on SRAM chips that have been aged for as little as four hours at 85C.