Long-term data remanence in SRAMs can pose serious security risks when ICs containing sensitive information are discarded at the end of their operational life. Sensitive information can fall into unauthorized hands if these ICs are not sanitized properly. Traditionally, data remanence has been addressed primarily in DRAM and flash memories, while SRAMs have been overlooked due to very short retention periods. Hovanes et al. [1] demonstrated that SRAMs are vulnerable to data remanence attacks, which can retrieve static data, such as firmware and keys. Their method exploits aging-induced imprints on power-up states, enabling partial recovery by comparing aged states with the originals. Although effective, this method requires maintaining records of all initial power-up states. In this paper, we propose a data recovery approach that does not require access to prior information. Our method also exploits data imprinting in SRAMs, but instead of using actual initial power-up states, we employ controlled aging to reconstruct them. Experiments on SRAM chips storing a binary image demonstrated near-complete recovery after 12 hours of controlled aging at 100◦C using 32 copies.

Ensuring the authenticity of integrated circuits in complex semiconductor supply chains requires noninvasive methods for identifying device provenance. This work investigates whether SRAM power-up states contain structural signatures, referred to in this work as SRAM DNA, that distinguish memory families beyond traditional device-unique Physical Unclonable Functions (PUFs). We analyze eight commercial 4-Mbit SRAM families (15 chips per family) and collect multiple power-up measurements from each device. Each power-up state is reshaped into a 2048×2048 binary grid, enabling spatial analysis of the full memory array. From these grids we extract interpretable multi-scale descriptors capturing global bias, spatial periodicity, texture statistics, and directional anisotropy. A Random Forest classifier evaluated under chip-level holdout validation (Leave-M-Chips-Per-Family) achieves more than 99.5% accuracy and macro-F1 score, demonstrating strong generalization to unseen devices with only a few power-up measurements per chip. These results show that SRAM power-up states encode reproducible family-level spatial organization reflecting memory-array structure and manufacturing characteristics.

This paper presents TCFlash, a practical and immediately deployable technique for executing bulk bitwise operations directly within commercial off-the-shelf (COTS) 3D NAND flash chips, using only standard user-mode commands. TCFlash enables in-place bitwise computation by combining logical data encoding of triple level-cell (TLC) storage with dynamic read reference voltage shifting. We demonstrate TCFlash across multiple 3D TLC NAND devices spanning both floatinggate and charge-trap technologies from two major vendors. To our knowledge, this is the first on-chip demonstration of error-free bitwise operations in 3D NAND. Experimental evaluation across vertical layers in the 3D NAND stack shows that TCFlash achieves zero raw bit error rate (RBER) for two-operand OR, AND, and XNOR operations, and RBER is below 0.006% for NAND, NOR, and XOR. Additionally, for the first time, we also demonstrate simultaneous three-operand bitwise operations with RBER below 0.008%.

Instant data deletion (or sanitization) in NAND flash devices is essential for achieving data privacy, but it remains challenging due to the mismatch between erase and write granularities, which leads to high overhead and accelerated wear. While page-overwrite-based instant data sanitization has proven effective for 2D NAND, its applicability to 3D NAND is limited due to the unique sub-block architecture. In this study, we experimentally evaluate page-overwrite-based sanitization on commercial 3D NAND flash memory chips and uncover significant threshold voltage disturbances in erased cells on adjacent pages within the same layer but across different sub-blocks. Our key findings reveal that page-overwrite sanitization increases the median raw bit error rate (RBER) beyond correction limits (exceeding 0.93%) in Floating-Gate (FG) Single-Level Cell (SLC) technology, whereas Charge-Trap (CT) SLC 3D NAND flash memories exhibit higher robustness. In Triple-Level Cell (TLC) 3D NAND, page-overwrite sanitization proves impractical, with the median RBER of ∼13% for FG and ∼5% for CT devices. To overcome these challenges, we propose PULSE , a low-disturbance sanitization technique that balances sanitization efficiency ( \({{\eta }_{san}}\) ) and data integrity (RBER). Experimental results show that PULSE eliminates RBER increases in SLC devices and reduces the median RBER to below 0.57% for FG and 0.79% for CT in fresh TLC blocks, demonstrating its practical viability for 3D NAND flash sanitization.

Continual vertical scaling in 3D NAND flash solid-state drives (SSDs) results in larger memory blocks, causing performance degradation due to big-block management issues. Pages within a 3D NAND flash block are traditionally written using layer first write sequencing. This paper introduces and explores the benefits of an alternative sub-block first write sequence. This method when coupled with sub-block erase operations promises to alleviate the big-block problem. Our evaluation on a commercial 32-layer 3D NAND flash SSD chip shows that though the proposed method increases the raw bit error rate (RBER), it remains below the threshold that can be corrected by error correction codes (ECCs). Simulation analysis further shows that our proposed method reduces garbage collection overhead, resulting in 36.0% lower response time and 9.6% reduction in additional writes due to garbage collection compared to traditional 3D NAND flash SSDs.

In this paper, we evaluate thermal annealing effects on the endurance of commercial off-the-shelf (COTS) 3D NAND flash memory beyond its end-of-life. We systematically evaluate the effects of anneal duration, anneal temperature, and state of the memory cells during annealing on the endurance enhancement. Interestingly, we find that endurance enhancement critically depends on the state of flash memory cells during annealing, with programmed cells showing significantly larger improvements than erased cells. Our experimental evaluation indicates that the post-cycle data retention property of an annealed chip significantly improves after thermal annealing, resulting in ~30% endurance recovery. Our results have significant implications for the future wear-leveling algorithms of SSD-based storage systems.

The infiltration of counterfeit electronics into the global supply chain is a growing concern that poses significant challenges for both manufacturers and consumers. This paper introduces Flash-Odometer, an innovative technique designed to estimate the age and usage statistics of NAND flash memory blocks. Flash-Odometer works by analyzing key characteristics of NAND arrays, which are highly dependent on the defect density in the gate dielectric of the flash memory cells. Our experimental evaluation, conducted on state-of-the-art 3D NAND chips from a leading manufacturer, demonstrates that the Flash-Odometer accurately predicts the program-erase (PE) cycle count of NAND memory blocks. This provides a unique and reliable method for estimating chip usage, which is instrumental in detecting recycled memory chips.

In this paper, we propose a new page-writing technique to hide secret information using the threshold voltage variation of programmed memory cells. We demonstrate the proposed technique on the state-of-the-art commercial 3D NAND flash memory chips by utilizing common user mode commands. We explore the design space metrics of interest for data hiding: bit accuracy of public and secret data and detectability of holding secret data. The proposed method ensures more than 97% accuracy of recovered secret data, with negligible accuracy loss in the public data. Our analysis shows that the proposed technique introduces negligible distortions in the threshold voltage distributions. These distortions are lower than the inherent threshold voltage variations of program states. As a result, the proposed method provides a hiding technique that is undetectable, even by a powerful adversary with low-level access to the memory chips.

Deleting data instantly from NAND flash memories incurs hefty overheads, and increases wear level. Existing solutions involve unlinking the physical page addresses making data inaccessible through standard interfaces, but they carry the risk of data leakage. An all-zero-in-place data overwrite has been proposed as a countermeasure, but it applies only to SLC flash memories. This paper introduces an instant page data sanitization method for MLC flash memories that prevents leakage of deleted information without any negative effects on valid data in shared pages. We implement and evaluate the proposed method on commercial 2D and 3D NAND flash memory chips.

Electronic device fingerprints, unique bit vectors extracted from device's physical properties, are used to differentiate between instances of functionally identical devices. This article introduces a new technique that extracts fingerprints from unique properties of partially erased NOR flash memory cells in modern microcontrollers. NOR flash memories integrated in modern systems-on-a-chip typically hold firmware and read-only data, but they are increasingly in-system-programmable, allowing designers to erase and program them during normal operation. The proposed technique leverages partial erase operations of flash memory segments that bring them into the state that exposes physical properties of the flash memory cells through a digital interface. These properties reflect semiconductor process variations and defects that are unique to each microcontroller or a flash memory segment within a microcontroller. The article explores threshold voltage variation in NOR flash memory cells for generating fingerprints and describes an algorithm for extracting fingerprints. The experimental evaluation utilizing a family of commercial microcontrollers demonstrates that the proposed technique is cost-effective, robust, and resilient to changes in voltage and temperature as well as to aging effects.

Counterfeit electronics represents a significant concern because recycled, over-produced, out-of-spec, or cloned chips can enter globalized supply chains. This paper introduces Flashmark, a technique for watermarking of NOR flash memories for counterfeit detection. Flashmark relies on novel approaches for (a) imprinting watermarks into dedicated blocks of flash memory chips by repeated stressing, thus irreversibly changing physical properties of flash memory cells, and (b) reading out watermarks by sensing the changes in physical properties of flash cells through standard digital interfaces. The paper demonstrates Flashmark on embedded NOR flash memories in a family of low-cost microcontrollers.

With the large-scale adaptation of a "horizontal" business model, modern semiconductor supply chain is plagued by recycled and counterfeit ICs, including flash memory chips. Since flash memory modules have an inherently finite lifespan, detection of recycled flash memory chips before their deployment in safety-critical systems is important to prevent disastrous consequences. The state-of-art detection methods can detect flash memory modules between 0.05% to 3.00% of their lifespan as minimum usage duration, depending on the details of the flash memory chip. In this paper, we propose a versatile machine learning assisted detection methodology to improve the minimum usage duration accuracy between 0.05% to 0.96% of their lifespan, and also to accurately associate a flash memory IC with its manufacturer. Through detailed experimentation and comparison of detection results obtained using three popular supervised machine learning techniques (Support Vector Machines, Logistic Regression and Artificial Neural Networks), we demonstrate that usage of features composed of multiple characteristics of a given chip, rather than just a single property of a chip (as used in previous works), improves detection accuracy.

This paper introduces a new technique that perturbs split-gate NOR Flash memory cells and extracts randomness of read noise to generate true random numbers. Flash memory cells exhibit threshold voltage fluctuations during read operations caused by thermal noise and random telegraph noise effects. Recent proposals demonstrate how these inherent properties of Flash memory cells can be used to create true random numbers in modern NAND Flash memories. However, they cannot be directly applied to NOR Flash memories in microcontrollers that have different architecture, improved data retention, high endurance, and are not as susceptible to noise as high-density NAND Flash memories. The proposed technique is experimentally demonstrated and evaluated using a family of commercial microcontrollers. The evaluation shows that it enables extraction of high-throughput random sequences that pass the NIST statistical tests. Advantages of the proposed technique are as follows: (a) it does not require any special hardware and/or interface modifications, (b) it is robust, cost-effective, and high-throughput, (c) it is entirely implemented in software, and (d) it is flexible and can be tailored to work in low-end microcontrollers that are often resource- or cost-constrained.