Hidden fault attack detection method and device for SILC authentication encryption algorithm, computer equipment and storage medium

Abstract

The invention provides a hidden fault attack detection method for an SILC authentication encryption algorithm, and the method comprises the steps: obtaining a plurality of authentication tags outputted by target encryption equipment, and obtaining a tag set; setting a plurality of groups of sub-key candidate sets; wherein each group of sub-key candidate sets corresponds to one fault import position, and the sub-key candidate sets exhausts all sub-key candidate values affected by the fault after the fault is imported at the corresponding fault import position; judging whether the master key can be recovered according to the label set and each group of sub-key candidate sets; and if yes, judging that the target encryption equipment is subjected to the hidden fault attack in the preset period. According to the scheme, hidden fault attacks possibly causing leakage of the master key or failure of the encryption system can be found and handled as early as possible, and the encryption security of the target encryption equipment and the confidentiality and integrity of related information are powerfully guaranteed.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, computer equipment and storage medium for detecting hidden fault attacks of a SILC authentication encryption algorithm. Background Art

[0002] With the booming development of the Internet of Things, various smart devices such as smart gateways, smart sensors and RFID have been widely used in smart homes, smart cities and telemedicine. In an open network environment, information is inevitably subject to threats such as interception, tampering and forgery during transmission, storage and processing. However, due to the limited resources and capabilities of small and medium-sized devices in the Internet of Things, traditional cryptography is difficult to effectively protect the confidentiality, integrity and authentication of information. Therefore, lightweight cryptography that combines high security and low consumption has attracted widespread attention from researchers at home and abroad.

[0003] The SILC (SImple Lightweight CFB) authentication encryption mode is based on the CFB working mode. Its underlying layer can use lightweight block cipher algorithms such as AES, SIMON, LED and PRESENT as the encryption part. Its software implementation has small memory consumption and code volume, and its hardware implementation has significant advantages in energy consumption and chip area. Therefore, SILC is considered to be a lightweight authentication encryption mode with associated data. With the support of the pseudo-randomness properties of the underlying block cipher, it has provable security and is therefore suitable for security implementation of devices with limited hardware resources.

[0004] In cryptanalysis, hidden fault attacks are an attack method based on the ciphertext-only assumption. Under this assumption, the attacker has minimal information and can only calculate the key of the cryptographic algorithm based on the mathematical relationship between ciphertexts. However, hidden fault attacks do not change the intermediate state of the encryption process, and traditional schemes are difficult to detect this type of attack. Summary of the invention

[0005] The purpose of this application is to solve at least one of the above-mentioned technical defects, and in particular to provide a set of effective detection solutions for whether a device using the SILC authentication encryption algorithm is subject to hidden fault attacks.

[0006] In a first aspect, the present application provides a hidden fault attack detection method for a SILC authentication encryption algorithm, comprising:

[0007] Acquire multiple authentication tags output by the target encryption device to obtain a tag set; the target encryption device encrypts based on the SILC authentication encryption mode, the target encryption device generates a hash value according to the associated data and random number corresponding to the plaintext message, obtains the ciphertext message according to the hash value and the plaintext message, and then obtains the authentication tag according to the hash value and the ciphertext message;

[0008] Setting multiple groups of subkey candidate sets; wherein each group of subkey candidate sets corresponds to a fault import position, and the subkey candidate sets exhaustively list all subkey candidate values ​​affected by the fault after the fault is imported into the corresponding fault import position;

[0009] Determine whether the master key can be recovered based on the tag set and each group of subkey candidate sets;

[0010] If so, it is determined that the target encryption device has suffered a hidden fault attack within a preset period.

[0011] In one of the embodiments, the target encryption device needs to go through 32 rounds of operations to generate an authentication tag. The first 31 rounds of operations will obtain the intermediate state value of this round based on the subkey value corresponding to this round and the intermediate state value of the previous round. The 32nd round of operations will obtain the authentication tag based on the subkey value corresponding to this round and the intermediate state value of the previous round. The hidden fault introduced by the intermediate state value in the 29th round is a valid import; the subkey candidate value includes the subkey value of some bits affected by the fault of the corresponding fault introduction position in the 31st and 32nd rounds.

[0012] In one embodiment, determining whether the master key can be recovered based on the tag set and each group of subkey candidate sets includes:

[0013] Divide the tag set into multiple sub-tag sets;

[0014] For any sub-tag set, match the sub-key candidate set with the sub-tag set to determine the target sub-key candidate set corresponding to each sub-tag set;

[0015] Determine a correct subkey from among the subkey candidate values ​​included in each target subkey candidate set;

[0016] If the complete subkey values ​​of the 31st and 32nd rounds can be obtained based on all the correct subkeys, it is determined that the master key can be recovered, otherwise, it is determined that the master key cannot be recovered.

[0017] In one embodiment, matching the subkey candidate set with the subtag set to determine the target subkey candidate set corresponding to each subtag set includes:

[0018] Traverse the current subkey candidate set, and determine the traversed subkey candidate value as the target subkey candidate value;

[0019] According to the target subkey candidate value and each authentication tag in the subtag set, determine the intermediate state value corresponding to the target subkey candidate value and each authentication tag in the 29th round, and obtain the intermediate state value set corresponding to the target subkey candidate value;

[0020] Determine, based on the intermediate state value set, a maximum likelihood estimate of the impact of the intermediate state value corresponding to the 29th round on the fault introduction position corresponding to the target subkey candidate value when using the corresponding target subkey candidate value;

[0021] If the difference between the maximum likelihood estimation values ​​is less than the first threshold, it is determined that the current subkey candidate set does not match the subtag set;

[0022] Otherwise, the current subkey candidate set is determined to be the target subkey candidate set corresponding to the subtag set.

[0023] In one embodiment, determining, according to the target subkey candidate value and each authentication tag in the subtag set, an intermediate state value corresponding to the target subkey candidate value and each authentication tag in the 29th round includes:

[0024] Input the target subkey candidate value and authentication tag into the following expression to obtain the intermediate state value corresponding to the target subkey candidate value and each authentication tag in the 29th round:

[0025]

[0026]

[0027] in, is the intermediate state value corresponding to the target subkey candidate value and each authentication tag in the 29th round, represents the inverse operation of the nonlinear layer operation, represents the inverse operation of the linear layer operation, For certification label The simplified intermediate value, rk 31 andrk 32 are the target subkey candidate values ​​for rounds 31 and 32 respectively, ck0 is rk 32 The simplified intermediate value of ck1 is rk 31 The simplified intermediate value of .

[0028] In one of the embodiments, determining a correct subkey from among the subkey candidate values ​​included in each target subkey candidate set includes:

[0029] The target subkey candidate value with the largest maximum likelihood estimate is selected as the correct subkey value corresponding to the target subkey candidate set.

[0030] In one embodiment, the fault import locations are divided into four categories, the first category is:

[0031] The hidden fault is introduced into the ith nibble of the intermediate status value of round 29 and When the fault at the first type of fault introduction position affects the value of the 31st round subkey at the i, i+16, i+32, i+48 bits, and affects the value of the 32nd round subkey at the 4j-4 bit, ;

[0032] The second category is: the hidden fault is introduced into the i-th half byte of the intermediate state value of the 29th round and When the fault at the second type of fault introduction position affects the value of the 31st round subkey at the i, i+16, i+32, i+48 bits, and affects the value of the 32nd round subkey at the 4j-3 bit, ;

[0033] The third category is: the hidden fault is introduced into the i-th half byte of the intermediate state value of the 29th round and When the fault at the third type of fault introduction position affects the value of the 31st round subkey at the i, i+16, i+32, i+48 bits, and affects the value of the 32nd round subkey at the 4j-2 bit, ;

[0034] The fourth category is: hidden faults are introduced into the ith half byte of the intermediate state value of the 29th round and When the fault at the fourth type of fault introduction position affects the value of the 31st round subkey at the i, i+16, i+32, i+48 bits, and affects the value of the 32nd round subkey at the 4j-1 bit, .

[0035] In a second aspect, the present application provides a hidden fault attack detection device for a SILC authentication encryption algorithm, comprising:

[0036] The data acquisition module is used to acquire multiple authentication tags output by the target encryption device to obtain a tag set; the target encryption device encrypts based on the SILC authentication encryption mode, the target encryption device generates a hash value according to the associated data and random number corresponding to the plaintext message, and obtains the ciphertext message according to the hash value and the plaintext message, and then obtains the authentication tag according to the hash value and the ciphertext message;

[0037] A setting module, used to set multiple groups of subkey candidate sets; wherein each group of subkey candidate sets corresponds to a fault import position, and the subkey candidate set exhaustively lists all subkey candidate values ​​affected by the fault after the fault is imported into the corresponding fault import position;

[0038] The judgment module is used to judge whether the master key can be recovered according to the tag set and each group of subkey candidate sets, and if the judgment result is yes, it is determined that the target encryption device has suffered a hidden fault attack within a preset period.

[0039] In a third aspect, the present application provides a computer device comprising one or more processors and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the steps of the hidden fault attack detection method of the SILC authenticated encryption algorithm in any of the above-mentioned embodiments are executed.

[0040] In a fourth aspect, the present application provides a computer-readable storage medium, which stores computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the hidden fault attack detection method of the SILC authenticated encryption algorithm in any of the above-mentioned embodiments.

[0041] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0042] This scheme needs to obtain a label set consisting of multiple authentication labels output by the target encryption device, and then set multiple groups of subkey candidate sets, each group corresponds to a specific fault import location, and exhaustively lists the subkey candidate values ​​affected after the fault import, so that the abnormal conditions of subkeys under different fault scenarios can be fully considered. Then, it is determined whether the master key can be restored based on the label set and each subkey candidate set. If it can be restored, it is determined that the target encryption device has suffered a hidden fault attack within the preset period. This scheme helps to discover and respond to hidden fault attacks that may cause the master key to be leaked or the encryption system to fail as early as possible, and effectively guarantees the encryption security of the target encryption device and the confidentiality and integrity of related information. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0044] Figure 1 A flowchart of a hidden fault attack detection method for a SILC authentication encryption algorithm provided by an embodiment of the present application;

[0045] Figure 2 Flowchart of SILC authentication encryption algorithm;

[0046] Figure 3 A schematic diagram of the fault transmission during the process of generating the authentication tag;

[0047] Figure 4 A schematic diagram of a process for determining whether a master key can be restored in one embodiment of the present application;

[0048] Figure 5 An internal structure diagram of a computer device provided for one embodiment of the present application. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, and do not belong to all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0050] This application provides a hidden fault attack detection method for SILC authentication encryption algorithm, please refer to Figure 1 , including steps S102 to S108.

[0051] S102, obtaining multiple authentication tags output by the target encryption device to obtain a tag set.

[0052] It can be understood that the target encryption device is the device that needs to be tested for fault attacks. The target encryption device is encrypted based on the SILC authentication encryption mode. In the SILC authentication encryption mode, the target encryption device will generate a hash value based on the associated data and random number corresponding to the plaintext message, and obtain the ciphertext message based on the hash value and the plaintext message, and then obtain the authentication tag based on the hash value and the ciphertext message. For details, please refer to Figure 2 , the hash value is generated using Figure 2 The HASH function in the HASH function is implemented. A in the HASH function input represents the associated data corresponding to the plaintext message, and N represents a randomly generated random number. The output of the HASH function is the hash value V. The generation of the ciphertext message is based on Figure 2 The ENC function in the ENC function input V represents the hash value output by the HASH function, and M represents the plaintext message to be encrypted. The output of the ENC function is the ciphertext message C. The authentication tag is generated using Figure 2 The PRF function in the PRF function is implemented. The V in the PRF function input represents the hash value output by the HASH function, and C represents the ciphertext message. The output of the PRF function is the authentication tag T. Figure 2 The DEC function in will be used to decrypt the ciphertext message. The C in its input represents the ciphertext message C to be decrypted, and V represents the hash value V corresponding to the ciphertext message C.

[0053] In SILC authentication encryption mode, in order to ensure the security and integrity of the data, the target encryption device will perform a series of complex operations on the plaintext message to be processed. Each plaintext message has a one-to-one corresponding ciphertext message and authentication tag. This step is to continuously collect the authentication tags produced during the actual operation of the target encryption device, obtain multiple such authentication tags and form a set. The tag set will serve as the basic data source for subsequent analysis of whether the target encryption device has been attacked by hidden faults.

[0054] S104, setting multiple groups of subkey candidate sets, wherein each group of subkey candidate sets corresponds to a fault introduction position, and the subkey candidate set exhaustively lists all subkey candidate values ​​affected by the fault after the fault is introduced at the corresponding fault introduction position.

[0055] It can be understood that hidden fault attacks will not cause the encryption algorithm to output erroneous information, but hidden faults introduced at specific locations will cause the distribution of certain bits of the intermediate state value of the authentication tag to aggregate to the corresponding specific values, and the aggregation trend of the intermediate state value will eventually be reflected on the authentication tag. According to the authentication tag, it is possible to infer which bits of the intermediate state value are affected. The values ​​of these bits are only affected by the values ​​of the subkeys at some positions. By exhaustively enumerating the values ​​of the subkeys at these positions, it is possible to obtain a subkey candidate value that affects the intermediate state value at a specific position under a fault introduction condition, and thus obtain a subkey candidate set. According to the specific aggregation of the intermediate state value, it is possible to infer which of the subkey candidate values ​​is the correct subkey value. Moreover, since the bits of the intermediate state value affected by different fault introduction positions are different, each group of subkey candidate sets has a one-to-one correspondence with the fault introduction position. The introduction of hidden faults can be achieved by changing the environment in which the target encryption device is located, specifically by changing the physical factors such as clock, voltage, humidity, radiation, pressure, light and eddy current.

[0056] S106, judging whether the master key can be restored according to the tag set and each group of subkey candidate sets.

[0057] It can be understood that the tag set reflects the authentication tags output by the target encryption device over a period of time. If an attacker implements a hidden fault attack, he needs to infer the aggregation trend of the intermediate state value based on the authentication tag, and then infer the partial value of the subkey. By applying hidden faults to the target encryption device multiple times, multiple groups of partial values ​​of subkeys can be obtained, so that there is a chance to restore the complete subkey. The key expansion algorithm between the subkey and the master key is known. As long as the complete subkey is restored, the master key can be successfully restored, thereby cracking the ciphertext message. Therefore, assuming that the master key of the target encryption device is in a safe state, the intermediate state value will not have a statistical special aggregation problem, or the attacker can only restore part of the subkey, then the master key cannot be restored based on the tag set and each group of subkey candidate sets. However, if the master key can be successfully restored based on the tag set and each group of subkey candidate sets, it means that the target encryption device must have experienced a hidden fault attack. Therefore, the criterion for judging whether it has suffered a hidden fault attack in this embodiment is whether the master key can be restored.

[0058] S108: If yes, it is determined that the target encryption device has suffered a hidden fault attack within a preset period.

[0059] This scheme needs to obtain a label set consisting of multiple authentication labels output by the target encryption device, and then set multiple groups of subkey candidate sets, each group corresponds to a specific fault import location, and exhaustively lists the subkey candidate values ​​affected after the fault import, so that the abnormal conditions of subkeys under different fault scenarios can be fully considered. Then, it is determined whether the master key can be restored based on the label set and each subkey candidate set. If it can be restored, it is determined that the target encryption device has suffered a hidden fault attack within the preset period. This scheme helps to discover and respond to hidden fault attacks that may cause the master key to be leaked or the encryption system to fail as early as possible, and effectively guarantees the encryption security of the target encryption device and the confidentiality and integrity of related information.

[0060] In one embodiment, see Figure 3 ,The process of generating the authentication tag by the target encryption device needs 32 rounds of operations. The first 31 rounds of operations will obtain the intermediate state value of this round according to the sub-key value corresponding to this round and the intermediate state value of the previous round. Figure 3 middle It is the intermediate state value of the 29th round, which is based on the subkey rk of the 30th round 30 The intermediate state value of the 30th round is obtained. In the 32nd round of operation, it will be based on the subkey value rk of the 32nd round 32 and the intermediate state value of the previous round to obtain the authentication tag T. In this embodiment, the hidden fault introduced in the intermediate state value of the 29th round is effectively introduced. Figure 3It can be seen that the random half-byte fault injected into the intermediate state value in the 29th round will be gradually transmitted to the subsequent intermediate state values ​​and the final authentication tag as the encryption proceeds. The fault introduced in the 29th round will cause some bits of the intermediate state values ​​processed in the 31st and 32nd rounds to aggregate (i.e., the blue area in the figure). Figure 3 As shown, taking the introduction of a fault in the 0th half byte of the intermediate state value of the 29th round as an example, the subkeys affected by the fault are the 0th, 16th, 32nd, and 48th bits of the 31st round and the 4j-4th bit of the 32nd round. , a total of 20 bits, each bit can be 0 or 1, exhaustively enumerate the values ​​of these affected bits, and the values ​​of the remaining bits can be applied with the same fixed value. Finally, the subkey candidate value set only needs to include 2 20 Compared with exhaustively enumerating 64-bit candidate values, the search space is greatly reduced.

[0061] In a specific embodiment, the fault introduction position can be divided into four categories according to the different fault propagation paths, and each category includes multiple byte positions. The first category is:

[0062] The hidden fault is introduced into the ith nibble of the intermediate status value of round 29 and The fault at the first type of fault introduction position affects the values ​​of the 31st round subkey at the i, i+16, i+32, and i+48 bits, and affects the value of the 32nd round subkey at the 4j-4 bit. .

[0063] The second category is: the hidden fault is introduced into the i-th half byte of the intermediate state value of the 29th round and The fault at the second type of fault introduction position affects the value of the 31st round subkey at the i, i+16, i+32, i+48 bits, and affects the value of the 32nd round subkey at the 4j-3 bit. .

[0064] The third category is: the hidden fault is introduced into the i-th half byte of the intermediate state value of the 29th round and The fault at the third type of fault introduction position affects the value of the 31st round subkey at the i, i+16, i+32, i+48 bits, and affects the value of the 32nd round subkey at the 4j-2 bit. .

[0065] The fourth category is: hidden faults are introduced into the ith half byte of the intermediate state value of the 29th round and The fault at the fourth type of fault introduction position affects the value of the 31st round subkey at the i, i+16, i+32, i+48 bits, and affects the value of the 32nd round subkey at the 4j-1 bit. .

[0066] In one embodiment, it is determined whether the master key can be recovered based on the tag set and each set of subkey candidate sets. Figure 4 , including steps S402 to S408.

[0067] S402: Divide the tag set into multiple sub-tag sets.

[0068] It can be understood that the sub-tag set is a number of smaller sets obtained by dividing the above complete tag set according to certain rules or requirements, and each sub-tag set contains a part of the authentication tags in the original tag set. Considering that the complete tag set may infer that the intermediate state values ​​are significantly clustered in multiple different positions, making it difficult to conduct targeted analysis, dividing the tag set can eliminate this situation, so that the sub-tag set can distinguish which type of clustering is the most significant.

[0069] S404: For any sub-tag set, match the sub-key candidate set with the sub-tag set to determine the target sub-key candidate set corresponding to each sub-tag set.

[0070] It can be understood that since different clustering situations are manifestations of different bits of the subkey being affected by hidden faults, only a specific subkey candidate set will cause the intermediate state values ​​corresponding to the subtag set to cluster at the corresponding position. Therefore, it is necessary to find the corresponding subkey candidate set for each subtag set.

[0071] This step can specifically be to select each subkey candidate set to match the subtag set, and the selected subkey candidate set is the current subkey candidate set. The current subkey candidate set is traversed, and the traversed subkey candidate value is determined as the target subkey candidate value. According to the target subkey candidate value and each authentication tag in the subtag set, the intermediate state value corresponding to the target subkey candidate value and each authentication tag in the 29th round is determined, and the intermediate state value set corresponding to the target subkey candidate value is obtained. To determine the intermediate state value of the 29th round, the target subkey candidate value and the authentication tag can be input into the following expression to obtain the intermediate state value corresponding to the target subkey candidate value and each authentication tag in the 29th round:

[0072]

[0073]

[0074] in, is the intermediate state value corresponding to the target subkey candidate value and each authentication tag in the 29th round, represents the inverse operation of the nonlinear layer operation, represents the inverse operation of the linear layer operation, For certification label The simplified intermediate value, rk 31 andrk 32 are the target subkey candidate values ​​for rounds 31 and 32 respectively, ck0 is rk 32 The simplified intermediate value of ck1 is rk 31 The simplified intermediate value of rk in this step 32 andrk 31 and Figure 3 The difference in Figure 3 Where is any subkey, only the candidate value of the subkey needs to be entered.

[0075] After obtaining the intermediate state value set, the maximum likelihood estimate of the intermediate state value corresponding to the 29th round at the fault introduction position corresponding to the target subkey candidate value when using the corresponding target subkey candidate value can be determined. The maximum likelihood estimate reflects whether the multiple intermediate state values ​​corresponding to the subtag set are clustered under the influence of the subkey candidate values ​​of the current subkey candidate set. If the difference between the maximum likelihood estimates is less than the first threshold, it means that it does not appear, and it can be determined that the current subkey candidate set does not match the subtag set. Otherwise, it can be determined that the current subkey candidate set is the target subkey candidate set corresponding to the subtag set.

[0076] S406: Determine a correct subkey from the subkey candidate values ​​included in each target subkey candidate set.

[0077] Specifically, the target subkey candidate value with the largest maximum likelihood estimate can be selected as the correct subkey value corresponding to the target subkey candidate set. In the presence of hidden faults, different subkey candidate values ​​will cause different aggregations of intermediate state values ​​due to the impact of hidden faults on different bits. The correct subkey should be the value that can best reflect the intermediate state value that should be present when the encryption system is operating normally under the influence of hidden faults among all possible subkey candidate values.

[0078] The target subkey candidate value with the largest maximum likelihood estimate value indicates that under the influence of this value, the aggregation of the intermediate state values ​​is most consistent with the internal rules of the encryption system under the influence of hidden faults. In other words, when facing the influence of hidden faults on each bit, the subkey candidate value corresponding to this value can make the intermediate state value present the aggregation or distribution state that is closest to that in the normal encryption process, so it is more likely to be the subkey actually used under normal operation, that is, the correct subkey.

[0079] S408: If the complete subkey values ​​of the 31st and 32nd rounds can be obtained based on all the correct subkeys, it is determined that the master key can be restored; otherwise, it is determined that the master key cannot be restored.

[0080] It can be understood that the subkeys of rounds 31 and 32 can be used to reverse the master key using the following algorithm:

[0081]

[0082] in, Represents a bitwise exclusive OR operation, Represents a concatenation operation. Indicates that string a is logically shifted right by x bits. Indicates that string a is cyclically shifted right by x bits. K is the primary key. The length of K is 80 bits. Indicates the bits from high to low of K. Therefore, as long as the subkeys of rounds 31 and 32 are recovered, the master key can be recovered.

[0083] The expression used in the description of step S404 is obtained based on the following simplified process. Specifically, the intermediate state value of the 30th round is The intermediate state value of the 29th round The relationships between them are:

[0084] . Among them, SL represents nonlinear layer operation, PL represents linear layer operation, and rk 30 Indicates the subkey of round 30. The intermediate state value of round 31 The intermediate state value of the 30th round The relationships between them are: rk 31 Indicates the subkey of round 31. The final authentication tag The intermediate state value of the 31st round The relationships between them are: . Due to rk 30 Without being affected by the half-byte failure, the above formulas can be combined and simplified into the expression used in the description of step S404.

[0085] The present application provides a hidden fault attack detection device for a SILC authentication encryption algorithm, comprising a data acquisition module, a setting module and a judgment module.

[0086] The data acquisition module is used to obtain multiple authentication tags output by the target encryption device to obtain a tag set. The target encryption device encrypts based on the SILC authentication encryption mode. The target encryption device will generate a hash value based on the associated data and random number corresponding to the plaintext message, and obtain the ciphertext message based on the hash value and the plaintext message, and then obtain the authentication tag based on the hash value and the ciphertext message.

[0087] The setting module is used to set multiple groups of subkey candidate sets. Each group of subkey candidate sets corresponds to a valid import situation, each valid import situation corresponds to a fault import position, and the subkey candidate set exhaustively lists all subkey candidate values ​​affected by the fault after the fault is imported at the corresponding fault import position.

[0088] The judgment module is used to judge whether the master key can be recovered according to the tag set and each group of subkey candidate sets, and if the judgment result is yes, it is determined that the target encryption device has suffered a hidden fault attack within a preset period.

[0089] For the specific definition of the hidden fault attack detection device of the SILC authentication encryption algorithm, please refer to the definition of the hidden fault attack detection method of the SILC authentication encryption algorithm above, which will not be repeated here. Each module in the hidden fault attack detection device of the above-mentioned SILC authentication encryption algorithm can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules. It should be noted that the division of modules in the embodiment of the present application is schematic, which is only a logical function division, and there may be other division methods in actual implementation.

[0090] The present application provides a computer device, including one or more processors and a memory, wherein the memory stores computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the steps of the hidden fault attack detection method of the SILC authentication encryption algorithm in any of the above embodiments are executed.

[0091] Indicatively, Figure 5 As shown, Figure 5 A schematic diagram of the internal structure of a computer device provided in an embodiment of the present application. Figure 5 The computer device 500 includes a processing component 502, which further includes one or more processors, and a memory resource represented by a memory 501 for storing instructions executable by the processing component 502, such as an application. The application stored in the memory 501 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 502 is configured to execute instructions to perform the steps of the hidden fault attack detection method of the SILC authenticated encryption algorithm of any of the above embodiments.

[0092] The present application provides a computer-readable storage medium, in which computer-readable instructions are stored. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the hidden fault attack detection method of the SILC authenticated encryption algorithm in any of the above embodiments.

[0093] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0094] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can refer to each other.

[0095] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting hidden fault attacks of SILC authentication encryption algorithm, characterized in that: include: Obtain multiple authentication tags output by the target encryption device to obtain a tag set; The target encryption device encrypts based on the SILC authentication encryption mode, the target encryption device generates a hash value according to the associated data corresponding to the plaintext message and a random number, obtains a ciphertext message according to the hash value and the plaintext message, and then obtains the authentication tag according to the hash value and the ciphertext message; Setting multiple groups of subkey candidate sets; wherein each group of the subkey candidate sets corresponds to a fault introduction position, and the subkey candidate sets exhaustively list all subkey candidate values ​​affected by the fault after the fault is introduced at the corresponding fault introduction position; Determining whether the master key can be recovered based on the tag set and each group of the subkey candidate sets; If so, it is determined that the target encryption device has suffered a hidden fault attack within the preset period.

2. The hidden fault attack detection method according to claim 1, characterized in that: The process of generating the authentication tag by the target encryption device needs to go through 32 rounds of operations. The first 31 rounds of operations will obtain the intermediate state value of this round according to the subkey value corresponding to this round and the intermediate state value of the previous round. The 32nd round of operations will obtain the authentication tag according to the subkey value corresponding to this round and the intermediate state value of the previous round. The hidden fault introduced by the intermediate state value in the 29th round is a valid introduction; the subkey candidate value includes the subkey value of some bits affected by the fault of the corresponding fault introduction position in the 31st and 32nd rounds.

3. The hidden fault attack detection method according to claim 2, characterized in that: The determining whether the master key can be restored according to the tag set and each group of the subkey candidate sets includes: Dividing the tag set into a plurality of sub-tag sets; For any sub-tag set, matching the sub-key candidate set with the sub-tag set to determine a target sub-key candidate set corresponding to each sub-tag set; Determining a correct subkey from the subkey candidate values ​​included in each of the target subkey candidate sets; If the complete subkey values ​​of the 31st and 32nd rounds can be obtained based on all the correct subkeys, it is determined that the master key can be recovered, otherwise, it is determined that the master key cannot be recovered.

4. The hidden fault attack detection method according to claim 3, characterized in that: The matching of the subkey candidate set with the subtag set to determine a target subkey candidate set corresponding to each subtag set includes: Traversing the current subkey candidate set, and determining the traversed subkey candidate value as the target subkey candidate value; According to the target subkey candidate value and each of the authentication tags in the subtag set, determine the intermediate state value corresponding to the target subkey candidate value and each of the authentication tags in the 29th round, and obtain the intermediate state value set corresponding to the target subkey candidate value; Determine, according to the intermediate state value set, a maximum likelihood estimate of the effect of the intermediate state value corresponding to the 29th round on the fault introduction position corresponding to the target subkey candidate value when using the corresponding target subkey candidate value; If the difference between the maximum likelihood estimation values ​​is less than a first threshold, it is determined that the current subkey candidate set does not match the subtag set; Otherwise, the current subkey candidate set is determined to be the target subkey candidate set corresponding to the subtag set.

5. The hidden fault attack detection method according to claim 4, characterized in that: The determining, according to the target subkey candidate value and each of the authentication tags in the subtag set, the intermediate state value corresponding to the target subkey candidate value and each of the authentication tags in the 29th round includes: The target subkey candidate value and the authentication tag are input into the following expression to obtain the intermediate state value corresponding to the target subkey candidate value and each authentication tag in the 29th round: in, is the intermediate state value corresponding to the target subkey candidate value and each authentication tag in the 29th round, represents the inverse operation of the nonlinear layer operation, represents the inverse operation of the linear layer operation, The authentication label The simplified intermediate value, rk 31 andrk 32 are the target subkey candidate values ​​of the 31st and 32nd rounds respectively, ck0 is rk 32 The simplified intermediate value of ck1 is rk 31 The simplified intermediate value of .

6. The hidden fault attack detection method according to claim 4, characterized in that: The determining a correct subkey from the subkey candidate values ​​included in each of the target subkey candidate sets includes: The target subkey candidate value with the largest maximum likelihood estimate value is selected as the correct subkey value corresponding to the target subkey candidate set.

7. The hidden fault attack detection method according to claim 2, characterized in that: The fault introduction positions are divided into four categories, the first category is: The hidden fault is introduced into the i-th nibble of the intermediate state value of round 29 and The fault at the first type of the fault introduction position affects the value of the 31st round of subkeys at the i, i+16, i+32, i+48 bits, and affects the value of the 32nd round of subkeys at the 4j-4 bit, ; The second category is: the hidden fault is introduced into the i-th half byte of the intermediate state value of the 29th round and The fault at the fault introduction position of the second type affects the value of the 31st round of subkeys at the i, i+16, i+32, i+48 bits, and affects the value of the 32nd round of subkeys at the 4j-3 bits, ; The third category is: the hidden fault is introduced into the i-th half byte of the intermediate state value of the 29th round and When; the fault in the fault introduction position of the third type affects the value of the 31st round of subkeys at the i, i+16, i+32, i+48 bits, and affects the value of the 32nd round of subkeys at the 4j-2 bits, ; The fourth category is: the hidden fault is introduced into the i-th half byte of the intermediate state value of the 29th round and When; the fault at the fault introduction position of the fourth type affects the value of the 31st round of subkeys at the i, i+16, i+32, i+48 bits, and affects the value of the 32nd round of subkeys at the 4j-1 bit, .

8. A hidden fault attack detection device for SILC authentication encryption algorithm, characterized in that: include: A data acquisition module is used to acquire multiple authentication tags output by a target encryption device to obtain a tag set; The target encryption device encrypts based on the SILC authentication encryption mode, the target encryption device generates a hash value according to the associated data corresponding to the plaintext message and a random number, obtains a ciphertext message according to the hash value and the plaintext message, and then obtains the authentication tag according to the hash value and the ciphertext message; A setting module, used to set multiple groups of subkey candidate sets; wherein each group of the subkey candidate sets corresponds to a fault introduction position, and the subkey candidate set exhaustively lists all subkey candidate values ​​affected by the fault after the fault is introduced at the corresponding fault introduction position; The judging module is used to judge whether the master key can be recovered according to the tag set and each group of the subkey candidate sets, and if the judgment result is yes, determine that the target encryption device has suffered a hidden fault attack within the preset period.

9. A computer device, characterized in that: It includes one or more processors and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the hidden fault attack detection method of the SILC authentication encryption algorithm described in any one of claims 1-7 are executed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the hidden fault attack detection method of the SILC authenticated encryption algorithm as described in any one of claims 1-7.

Images