An attack positioning method, device and system for a white-box block cipher algorithm and a storage medium
By acquiring side-channel waveforms in real time and performing morphological feature analysis and waveform difference threshold matching, the problem of timing difficulty in white-box cryptographic fault injection attacks is solved, enabling precise attack location and efficient execution.
Patent Information
- Application Number
- CN202511744842.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-25
- Publication Date
- 2026-05-15
- Estimated Expiration
- 2045-11-25
AI Technical Summary
In the fault injection attack experiment implemented by white-box cryptography, the timing of the attack is difficult to control precisely, which makes it impossible to effectively inject faults into critical execution points. The lack of fine-grained observation capability of program execution flow and critical states leads to strong blindness in the attack process, increasing the time overhead and inefficiency of the attack.
By acquiring side-channel waveforms in real time and performing morphological feature analysis, the target rounds of the attack are determined. Then, by using waveform difference thresholds and cross-correlation analysis, the attack point is accurately located, including lightweight judgment and high-precision verification, gradually narrowing down the target range and ensuring accurate positioning of the attack injection timing.
It significantly improves the accuracy and success rate of attacks, reduces the blindness and time cost of attacks, and enhances the reliability and accuracy of attack location in complex environments.
Smart Images
Figure CN121308948B_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of information security technology, and in particular to a method, apparatus, system and storage medium for locating attacks on block white-box cryptographic algorithms. Background Technology
[0002] Research has revealed that in financial payments and digital content protection, white-box cryptography models are constructed to effectively hide encryption keys in insecure execution environments and prevent them from being extracted by attackers. This model assumes that attackers can completely observe and control the execution process of cryptographic software, deeply integrating key information into the implementation structure of the cryptographic algorithm to achieve effective key concealment. Since the protection mechanisms of white-box cryptography against fault injection attacks are still imperfect, fault injection attack experiments targeting white-box cryptographic implementations were conducted.
[0003] Currently, in white-box cryptography-based fault injection attack experiments, the timing of the attack is difficult to control precisely, making it impossible to effectively inject faults into critical execution points. Furthermore, the lack of fine-grained observation capabilities of program execution flow and critical states makes it difficult to accurately pinpoint the timing of fault injection, resulting in a highly unpredictable attack process, increased attack time overhead, and ultimately, poor attack accuracy and low attack efficiency. Summary of the Invention
[0004] This invention provides a method, apparatus, system, and storage medium for locating attacks using block cipher algorithms, aiming to at least solve the problem of poor attack accuracy and low efficiency caused by the inability to accurately identify the key execution points and precise injection timing during white-box cryptography fault injection attack experiments. The technical solution of this invention is as follows:
[0005] According to a first aspect of the present invention, an attack location method for a block white-box cryptographic algorithm is provided. The method includes: real-time acquisition of side-channel waveforms generated during the execution of the block white-box cryptographic algorithm; analysis of the morphological characteristics of the side-channel waveforms to determine the target round of the attack; determination of a target waveform region from the actual side-channel waveforms generated in the target rounds, wherein the waveform difference from a preset reference waveform is less than a difference threshold; and determination of the attack location point based on the target waveform region.
[0006] As one implementation method, from the actual side-channel waveform generated in the target round, a target waveform region with a waveform difference degree less than a preset reference waveform is determined. This includes: successively sampling the actual sampled values of a preset number of samples from the actual side-channel waveform according to the preset sampling step size and preset sampling number of the preset reference waveform, and successively determining the sum of the absolute differences between each actual sampled value and the corresponding preset sampled value in the preset number of samples; the preset sampled value is the sampled value corresponding to the preset sampling point of the preset reference waveform at each preset sampling step size; the waveform region corresponding to the actual sampled values of the preset number of samples whose sum of absolute differences is less than the first difference threshold is determined as the target waveform region.
[0007] In this implementation, the sum of absolute differences matching method is simple and fast to calculate, and is suitable for high sampling rate scenarios. It ensures that the range of attack targets is significantly narrowed while meeting real-time requirements, and provides a reliable technical basis for launching precise fault injection attacks.
[0008] As one implementation method, from the actual side-channel waveforms generated in the target round, a target waveform region with a waveform difference degree less than a preset reference waveform is determined. This includes: successively sampling a preset number of actual sampled values from the actual side-channel waveform according to the preset sampling step size and preset sampling number of the preset reference waveform, and successively determining the mean square of the difference between each actual sampled value in the preset sampling number and the corresponding preset sampled value; and determining the waveform region corresponding to the preset number of actual sampled values whose mean square difference is less than a second difference threshold as the target waveform region.
[0009] In this implementation, the mean square error (MSE) assigns a higher weight to larger deviations, making MSE matching extremely sensitive to sharp spikes, sudden impulse noise, or severe local distortions in the waveform. If the actual waveform shows a brief but significant difference from the reference waveform at a critical point (such as the beginning of a clock cycle), the MSE value will increase sharply, resulting in a match failure. This helps to more rigorously exclude waveform segments with similar overall shapes but significant local anomalies, thereby further improving the accuracy of positioning.
[0010] As one implementation method, the attack location point is determined based on the target waveform region, including: determining the start point, center point, or falling edge point in the target waveform region as the attack location point.
[0011] In this implementation, a waveform region is transformed into a precise time point, eliminating attack failures caused by unclear injection timing and achieving precise attack.
[0012] As one implementation method, the attack location point is determined based on the target waveform region, including: taking the target waveform region as the offset center on the actual side channel waveform, and successively collecting multiple candidate waveform regions that are offset forward or backward by a preset time offset; performing cross-correlation analysis on each candidate waveform region and a preset reference waveform to obtain the cross-correlation degree of each candidate waveform region; and determining the offset sampling point corresponding to the candidate waveform region whose cross-correlation degree reaches the maximum peak value as the attack location point.
[0013] In this implementation, by calculating the similarity of multiple candidate waveforms at different time offsets, their optimal alignment positions are identified, effectively detecting delays or phase shifts between waveforms. This approach demonstrates strong noise immunity and high matching accuracy. The offset sampling points in the candidate waveform region where the cross-correlation reaches its maximum peak are designated as attack location points, thus adding a final layer of security. This effectively prevents blind or misjudged attacks when matching quality is poor, further conserving attack resources and improving the success rate.
[0014] As one implementation method, a preset reference waveform is extracted from the actual waveforms generated during the execution of the block white-box cryptography algorithm, based on the execution path and preset waveform characteristics of the block white-box cryptography algorithm.
[0015] In this implementation, the preset reference waveform provides a clear and visual target for the attack. By matching the real-time waveform with the high-confidence reference waveform, the timing of fault injection can be locked with extreme precision, ensuring that the fault is injected into the predetermined instructions or data. This effectively reduces the blindness of the attack and improves the accuracy and success rate of the attack.
[0016] As a means of implementation, morphological characteristics include upward trend, downward trend, periodicity, and waveform amplitude variation.
[0017] According to a second aspect of the present invention, an attack location device for block white-box cryptography algorithms is provided, the attack location device for block white-box cryptography algorithms comprising:
[0018] The round identification unit is configured to collect side-channel waveforms generated during the execution of the block white-box cryptography algorithm in real time; analyze the morphological characteristics of the side-channel waveforms to determine the target round of the attack.
[0019] The waveform region determination module is configured to determine the target waveform region from the actual side channel waveform generated in the target round, where the waveform difference from the preset reference waveform is less than the difference threshold.
[0020] The attack location determination module is configured to determine the attack location based on the target waveform region.
[0021] According to a third aspect of the present invention, an attack location system for block white-box cryptographic algorithms is provided, the system being configured to perform an attack location method for block white-box cryptographic algorithms as described in the first aspect and any possible implementation thereof.
[0022] According to a fourth aspect of the present invention, an electronic device is provided, comprising: a processor and a memory for storing processor-executable instructions; wherein the processor is configured to execute the executable instructions to implement an attack location method for a block white-box cryptographic algorithm as described in the first aspect and any possible implementation thereof.
[0023] According to a fifth aspect of the present invention, a computer-readable storage medium is provided, on which instructions are stored, such that when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform an attack location method for a block white-box cryptographic algorithm as described in the first aspect and any possible implementation thereof.
[0024] According to a sixth aspect of the present invention, a computer program product is provided, the computer program product including computer instructions, which, when executed on an electronic device, cause the electronic device to execute the attack location method of the block white-box cryptographic algorithm described in the first aspect and any possible implementation thereof.
[0025] The technical solution provided by this invention brings at least the following beneficial effects: This application determines the attack location point of a fault injection attack in a tiered manner, from lightweight determination to high-precision verification, gradually narrowing down the target range and ensuring that the attack injection timing is accurately located. First, by performing morphological feature analysis on the real-time acquired side-channel waveform, coarse-grained identification of the encryption rounds is performed, providing a reliable identification benchmark for accurately identifying the target round and waveform region, effectively reducing the blindness of the attack. At the same time, the lightweight determination of morphological analysis can quickly eliminate a large number of non-target cycles, reducing the overhead of subsequent high-order algorithms and effectively shortening the attack time. Second, after confirming that the target round has been entered, a waveform matching algorithm is used to compare the point-by-point differences between the real-time waveform and the pre-determined reference waveform for fine-grained positioning, accurately determining the target waveform region, improving the ability to capture the attack injection timing, and thus determining the precise attack location point by analyzing the target waveform region. This application employs a multi-level fusion judgment mechanism to filter interference layer by layer, ensuring the reliability of attack location determination in complex environments. At the same time, the "from simple to complex" process significantly reduces false positives and false negatives, enabling attacks to more accurately target key waveform areas and effectively improving the attack success rate.
[0026] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description
[0027] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application, and do not constitute an undue limitation of this application.
[0028] Figure 1 This is a schematic diagram illustrating an attack detection system for a block white-box cryptographic algorithm according to an exemplary embodiment;
[0029] Figure 2 This is a flowchart illustrating an attack location method for a block white-box cryptography algorithm according to an exemplary embodiment;
[0030] Figure 3 This is a reference waveform diagram illustrating an attack location method for a block white-box cryptographic algorithm according to an exemplary embodiment;
[0031] Figure 4 This is a comparison chart of matching results for an attack location method of a block white-box cryptography algorithm according to an exemplary embodiment;
[0032] Figure 5 This is a block diagram illustrating an attack location device for a block white-box cryptographic algorithm according to an exemplary embodiment;
[0033] Figure 6 This is a schematic diagram of an electronic device according to an exemplary embodiment. Detailed Implementation
[0034] To enable those skilled in the art to better understand the technical solutions of this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.
[0035] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.
[0036] Before providing a detailed description of the attack location method for block white-box cryptography algorithms provided in this application embodiment, let's briefly introduce the application scenarios and implementation environment involved in this application embodiment.
[0037] First, a brief introduction to the application scenarios involved in this application will be given.
[0038] Research has revealed that a key challenge in fields such as financial payments and digital content protection is effectively hiding encryption keys in insecure execution environments to prevent attackers from extracting them. To address this, a white-box cryptography model has been proposed, assuming that attackers can completely observe and control the execution process of cryptographic software. In the attack scenarios described by this model, traditional key protection mechanisms are ineffective, and key information is easily leaked. Therefore, special techniques must be employed to deeply integrate key information into the implementation structure of the cryptographic algorithm to achieve effective key hiding. The core objective of white-box cryptography is to ensure key security in such white-box attack environments by obfuscating and hiding key information, preventing attackers from extracting keys during program execution. Therefore, it is increasingly important and has received widespread attention in current information security systems.
[0039] Currently, white-box cryptography's defense mechanisms against fault injection attacks are still inadequate. Even with experiments conducted on fault injection attacks against white-box cryptography, the timing of attacks remains difficult to control precisely, preventing faults from being effectively injected into critical execution points. Furthermore, when implementing fault injection attacks against white-box cryptographic systems, the lack of fine-grained observation of program execution flow and critical states makes it difficult for attackers to accurately pinpoint the injection opportunity, resulting in a highly unpredictable attack process. This not only significantly increases the attack's time cost but also leads to a low success rate and overall inefficiency.
[0040] To address the aforementioned issues, this application proposes an attack localization method for block cipher white-box cryptography algorithms. This method employs a tiered approach to determine the attack location of fault injection attacks, progressively narrowing the target range from lightweight assessment to high-precision verification, ensuring accurate pinpointing of the injection timing. A multi-level fusion assessment mechanism filters interference layer by layer, guaranteeing the reliability of attack location determination even in complex environments. Furthermore, the "from simple to complex" process significantly reduces false positives and false negatives, enabling attacks to more precisely target key waveform regions and effectively improving the attack success rate.
[0041] For ease of understanding, the attack location method of the block white-box cryptography algorithm provided in this application will be described in detail below with reference to the accompanying drawings.
[0042] Figure 1 This is a schematic diagram illustrating an attack detection system for a block cipher algorithm according to an exemplary embodiment. Figure 1 As shown, the attack localization system of the block white-box cryptography algorithm includes a first-level state round identification module 11, a second-level state behavior matching and fine-grained localization module 12, and a third-level state high-precision verification module 13.
[0043] The first-level state cycle identification module 11, the second-level state behavior matching and fine-grained positioning module 12, and the third-level state high-precision verification module 13 are connected by communication.
[0044] The first-level state round identification module 11 is configured to collect side-channel waveforms generated during the execution of the block white-box cryptography algorithm in real time. The morphological characteristics of the side-channel waveforms are analyzed to determine the target round of the attack.
[0045] The secondary state behavior matching and fine-grained positioning module 12 is configured to determine the target waveform region from the actual side channel waveform generated in the target round, whose waveform difference from the preset reference waveform is less than the difference threshold.
[0046] The three-level state high-precision verification module 13 is configured to, on the actual side channel waveform, take the target waveform region as the offset center, and successively collect multiple candidate waveform regions that are offset forward or backward by a preset time offset; perform cross-correlation analysis on each candidate waveform region and the preset reference waveform to obtain the cross-correlation degree of each candidate waveform region; and determine the offset sampling point corresponding to the candidate waveform region whose cross-correlation degree reaches the maximum peak value as the attack location point.
[0047] In one implementation, the first-level state cycle identification module 11 uses lightweight decision logic, such as morphological feature analysis, to determine the cycle of the first-level state. This logic is fast and can be used for high-frequency preliminary screening. It can quickly eliminate non-target execution cycles and reduce high-order computational overhead.
[0048] The secondary state of the behavior matching and fine-grained localization module 12 is activated after the primary state recognition conditions are met. It introduces a waveform matching algorithm of medium complexity, such as the sum of absolute differences (SAD) or mean squared error (MSE), to achieve fine-grained localization of the target waveform region.
[0049] The Level 3 High-Precision Verification Module 13 is an optional high-precision verification module that is only enabled in security-critical or high-confidence scenarios. It employs computationally intensive methods, including cross-correlation analysis, to further improve the accuracy of attack location.
[0050] In this implementation, the adjustable parameters and configurable state transition conditions of each level of the judgment module support dynamic adaptation to different execution scenarios, enhancing the flexibility and generalization ability of the attack strategy. For example, the matching thresholds of SAD and MSE can be dynamically adjusted according to the signal-to-noise ratio of the actual acquired signal; the transition conditions of the round counter can be flexibly set according to the number of rounds of the target algorithm; and the activation or deactivation of the third-level verification module can be controlled based on platform resources and attack accuracy requirements. It is precisely because of this modular and configurable design structure that the attack localization method of this application can dynamically adjust the judgment strategy based on runtime feedback, possessing adaptive capabilities to different white-box implementations, different hardware platforms, and dynamic execution variations, thereby expanding its applicability in diverse attack scenarios.
[0051] Figure 2 This is a flowchart illustrating an attack location method for a block white-box cryptography algorithm according to an exemplary embodiment, the method comprising the following steps.
[0052] S21, Real-time acquisition of side-channel waveforms generated during the execution of the block white-box cryptography algorithm.
[0053] Side-channel waveforms are graphs representing the changes over time of physical quantities related to the internal operation of a cryptographic device, as measured by physical sensors, during encryption operations.
[0054] Real-time acquisition of side channel waveforms provides a basis for subsequent determination of target rounds and target area waveforms.
[0055] S22, Analyze the morphological characteristics of the side channel waveform to determine the target round of the attack.
[0056] Morphological characteristics include upward trend, downward trend, periodicity, and waveform amplitude changes.
[0057] In one implementation, the current round of the encryption process is determined by observing the behavior of the program counter (PC). Once the round counter detects that a preset target round has been reached, the process enters a secondary state for target waveform region identification. Specifically, this involves the following two determination steps.
[0058] The round counter is used to record the number of complete encryption cycles that have been completed.
[0059] The program counter is a special register.
[0060] First, morphological analysis is used to identify program counter behavior.
[0061] Morphological analysis primarily relies on the geometric characteristics of the side-channel waveform, including parameters such as rise time, fall time, periodicity, and amplitude variation. By comparing the similarity of real-time waveforms with standard periodic waveforms in terms of geometric characteristics, the complete encryption cycle is determined, enabling coarse-grained identification of encryption rounds.
[0062] Common triggering and determination methods include, but are not limited to: rising edge triggering and determination, falling edge triggering and determination, groove triggering and determination, and threshold triggering and determination.
[0063] Secondly, when a complete encryption cycle is identified, the counter increments by one, until the counter reaches the preset target number of rounds.
[0064] For example, if the target round for fault injection is preset to be the Nth round, then after identifying the side channel waveform, the Nth round will be completed. After one complete encryption cycle, the target round for the attack is determined at the moment of entering the Nth round, and the secondary state is entered to determine the subsequent target waveform region.
[0065] In this implementation, a lightweight decision logic based on morphological analysis is adopted, which relies only on geometric features such as the rise time, fall time, periodicity and amplitude of the waveform for fast matching. The computational overhead is minimal, and the exclusion judgment can be completed quickly in most non-target execution cycles, avoiding the activation of high-complexity algorithms and improving the efficiency of locating critical attack moments.
[0066] S23, determine the target waveform region from the actual side channel waveform generated in the target round, where the waveform difference from the preset reference waveform is less than the difference threshold.
[0067] In one implementation, to accurately determine the target waveform region, the focus is on real-time matching and precise positioning of the program counter (PC) behavior. Since the program counter directly reflects the program execution flow and plays a crucial role in typical embedded platforms such as the ARM architecture, its change patterns can serve as an important criterion for injection timing. Based on this, the direct difference in waveforms can be identified to determine whether a preset trigger point has been reached. Determining the target waveform region specifically includes the following two steps.
[0068] First, extract the preset reference waveform.
[0069] Based on the execution path and preset waveform characteristics of the block white-box cryptography algorithm, a preset reference waveform is extracted from the actual waveforms generated during the execution of the block white-box cryptography algorithm.
[0070] like Figure 3 As shown, the waveforms generated in the known execution path are extracted to identify the waveforms corresponding to the attack targets in the execution flow of the cryptographic algorithm, which are then used as reference waveforms for the attack template.
[0071] Reference waveforms provide a clear and visual target for attacks. By matching real-time waveforms with high-confidence reference waveforms, the timing of fault injection can be pinpointed with extreme precision, ensuring that the fault is injected into the intended instructions or data. This effectively reduces the blindness of attacks and improves their accuracy and success rate.
[0072] Secondly, through waveform matching, the target waveform region with a waveform difference of less than the difference threshold from the preset reference waveform is determined.
[0073] There are two efficient waveform matching methods, both of which can be used for real-time matching and can be selected according to the timing and operation process.
[0074] Among these, the Sum of Absolute Differences (SAD) is more suitable for high-throughput scenarios. Mean Squared Error (MSE) is more sensitive to abnormal fluctuations.
[0075] The first method is the sum of absolute differences.
[0076] According to the preset sampling step size and preset sampling number of the preset reference waveform, the actual sampled values of the preset sampling number are successively sampled from the side channel wave, and the sum of the absolute differences between each actual sampled value and the corresponding preset sampled value is determined successively; the preset sampled value is the sampled value corresponding to the preset sampling point of the preset reference waveform at each preset sampling step size; the waveform region corresponding to the actual sampled value of the preset sampling number whose sum of absolute differences is less than the first difference threshold is determined as the target waveform region.
[0077] The preset sampling step size represents the time interval between two consecutive sampling points on the reference waveform.
[0078] The preset sampling number represents the number of sampling points taken in each comparison, and determines the size of the comparison sliding window.
[0079] The first difference threshold characterizes the standard for judging whether two waveform segments are similar.
[0080] The smaller the sum of the absolute differences, the more similar the two waveforms are. The actual waveform region corresponding to the sliding window is then determined to be the target waveform region, indicating the presence of an attack injection point.
[0081] Thus, the absolute difference sum matching method is simple and fast to calculate, and is suitable for high sampling rate scenarios. It ensures that the range of attack targets is significantly narrowed while meeting real-time requirements, and provides a reliable technical basis for launching precise fault injection attacks.
[0082] The second method is mean square error.
[0083] According to the preset sampling step size and preset sampling number of the preset reference waveform, the actual sampled values of the preset sampling number are sampled successively from the actual side channel wave, and the mean square of the difference between each actual sampled value and the corresponding preset sampled value is determined successively; the waveform region corresponding to the actual sampled values of the preset sampling number whose mean square of the difference is less than the second difference threshold is determined as the target waveform region.
[0084] The mean square error (MSE) matching algorithm uses squared terms, which significantly amplifies large differences at any sampling point. MSE assigns higher weight to larger deviations, making it extremely sensitive to sharp spikes, sudden impulse noise, or severe local distortions in the waveform. If the actual waveform shows a brief but significant difference from the reference waveform at a key point (such as the beginning of a cycle), the MSE value will increase sharply, resulting in a matching failure. This helps to more rigorously exclude waveform segments with similar overall shapes but significant local anomalies, thereby further improving the accuracy of positioning.
[0085] In one implementation, such as Figure 4 As shown, the red waveform represents the result of MSE calculation, and the green waveform represents the result of SAD calculation. By matching the real-time acquired side-channel waveform with a preset reference waveform using SAD or MSE, a matching degree curve can be obtained. When the matching degree is lower than a set threshold, it is determined to be a successful match, triggering fault injection or entering a high-precision verification state.
[0086] In this implementation, the SAD and MSE waveform matching algorithms achieve fine-grained positioning of the key execution interval corresponding to the PC program counter jump behavior by measuring the point-by-point difference between the real-time waveform and the preset reference waveform. This reduces the blindness of the attack, improves the ability to capture the target moment, and further improves the accuracy of attack positioning.
[0087] S24, Determine the attack location point based on the target waveform area.
[0088] After determining the target waveform region, the attack positioning point is determined based on the actual positioning accuracy requirements. This includes the following two scenarios.
[0089] Firstly, the attack location can be determined directly based on the target waveform area.
[0090] Specifically, the starting point, center point, or falling edge point in the target waveform region is determined as the attack location point.
[0091] Secondly, in scenarios requiring extremely high positioning accuracy, an algorithm with higher computational complexity but better matching accuracy is used to perform cross-correlation analysis to determine the attack location point.
[0092] Specifically, on the actual side channel waveform, with the target waveform region as the offset center, multiple candidate waveform regions are successively acquired by shifting forward or backward by a preset time offset; cross-correlation analysis is performed on each candidate waveform region and the preset reference waveform to obtain the cross-correlation degree of each candidate waveform region; the offset sampling point corresponding to the candidate waveform region with the maximum cross-correlation degree is determined as the attack location point.
[0093] For example, the real-time waveform from point 9980 to point 10020 (a total of 40 points, centered at point 10000) is captured. Cross-correlation analysis is performed between the reference waveform and this 40-point segment. The analysis reveals that the cross-correlation value reaches its maximum peak when the reference waveform slides two points to the right. Therefore, the system determines the final critical attack point to be the 10002nd sampling point. Finally, the fault injection trigger signal is issued precisely at the 10002nd point.
[0094] Thus, by calculating the similarity of multiple candidate waveforms at different time offsets and identifying their optimal alignment positions, the delay or phase shift between waveforms can be effectively detected, exhibiting strong noise resistance and high matching accuracy. The offset sampling points in the candidate waveform region where the cross-correlation reaches its maximum peak are determined as attack location points, thereby adding a final layer of security protection. This effectively prevents blind or misjudged attacks when the matching quality is poor, further conserving attack resources and improving the success rate.
[0095] Since the computational overhead of cross-correlation verification is relatively large, it can be flexibly configured according to actual attack requirements, platform resources and real-time constraints.
[0096] Optionally, after successfully completing multi-level state determination and confirming that the triggering conditions are met, the attack location is determined, an injection signal is generated, and a fault injection operation is performed. The injection strategy can be flexibly selected according to the attack target, including: injection model selection, single or multiple injections, and adjustment of injection duration, timing, and intensity.
[0097] In summary, this application significantly improves the time accuracy, reliability, and adaptability of side-channel analysis and fault injection attacks in white-box cryptographic environments by constructing a hierarchical decision architecture and integrating multiple waveform analysis methods. The multi-level state machine structure design, which proceeds from simple to complex and activates step-by-step, achieves a balance between efficiency and real-time performance, significantly reducing the system's average response latency. Specifically, the first-level state employs lightweight decision logic based on morphological analysis, relying solely on geometric features such as waveform rise time, fall time, periodicity, and amplitude for rapid matching. This results in minimal computational overhead, allowing for rapid elimination judgments within most non-target execution cycles, avoiding the initiation of highly complex algorithms. The second and third-level decision states are only triggered after the round counter confirms entry into the target encryption round. This mechanism of activating high-precision modules on demand ensures that complex SAD or MSE matching and cross-correlation analysis only run during critical time periods, thereby significantly reducing overall processing latency and improving the system's real-time response capability while maintaining final positioning accuracy.
[0098] Furthermore, the robustness of the judgment process is enhanced by constructing a three-level progressive judgment strategy of "coarse screening - fine judgment - verification," effectively suppressing false triggers and missed triggers. The first level, coarse screening, uses morphological features to achieve coarse-grained identification of encryption rounds, effectively addressing waveform fluctuations caused by environmental noise or minor variations in the execution path. The second level, fine judgment, introduces SAD and MSE waveform matching algorithms to measure point-by-point differences between real-time waveforms and preset templates, achieving fine-grained positioning of key execution intervals corresponding to PC jump behaviors, improving the ability to capture target moments. The third level, verification, enables cross-correlation analysis, calculating the similarity of waveforms at different time offsets through a sliding window, further correcting potential timing offsets or phase jitter, forming a high-confidence verification. This multi-level, multi-modal fusion judgment mechanism forms a defensive logical closed loop, significantly reducing the risk of misjudgment due to noise interference or model bias caused by a single criterion, and improving the stability and reliability of the system in complex execution environments.
[0099] To achieve the above functions, the attack location device for block white-box cryptography algorithms includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art will readily recognize that, based on the algorithmic steps of the examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.
[0100] This disclosure also provides an embodiment such as Figure 5The attack location device for the block white-box cryptography algorithm shown includes: a round identification unit 301, a waveform region determination unit 302, and an attack location point determination unit 303.
[0101] Round identification unit 301 is configured to collect side-channel waveforms generated during the execution of block white-box cryptography algorithms in real time; analyze the morphological characteristics of the side-channel waveforms to determine the target round of the attack.
[0102] The waveform region determination unit 302 is configured to determine a target waveform region from the actual side channel waveform generated in the target round, wherein the waveform difference from the preset reference waveform is less than a difference threshold.
[0103] The attack location determination unit 303 is configured to determine the attack location based on the target waveform region.
[0104] As one implementation, the waveform region determination unit 302 is specifically configured to determine, from the actual side-channel waveform generated in the target round, a target waveform region whose waveform difference from a preset reference waveform is less than a difference threshold. This includes: sequentially sampling a preset number of actual sampled values from the actual side-channel waveform according to a preset sampling step size and a preset sampling number of the preset reference waveform, and sequentially determining the sum of the absolute differences between each actual sampled value and its corresponding preset sampled value within the preset sampling number; the preset sampled value is the sampled value corresponding to the preset sampling point of the preset reference waveform at each preset sampling step size; and determining the waveform region corresponding to the preset number of actual sampled values whose sum of absolute differences is less than a first difference threshold as the target waveform region.
[0105] As one implementation, the waveform region determination unit 302 is specifically configured to determine, from the actual side-channel waveform generated in the target round, a target waveform region whose waveform difference from the preset reference waveform is less than a difference threshold. This includes: successively sampling the actual sampled values of a preset number of samples from the actual side-channel waveform according to the preset sampling step size and preset sampling number of the preset reference waveform, and successively determining the mean square of the difference between each actual sampled value and the corresponding preset sampled value in the preset number of samples; and determining the waveform region corresponding to the preset number of actual sampled values whose mean square difference is less than the second difference threshold as the target waveform region.
[0106] As one implementation, the attack location point determination unit 303 is specifically configured to determine the attack location point based on the target waveform region, including: determining the starting point, center point, or falling edge point in the target waveform region as the attack location point.
[0107] As one implementation method, the attack location determination unit 303 is specifically configured to determine the attack location point based on the target waveform region, including: taking the target waveform region as the offset center on the actual side channel waveform, successively collecting multiple candidate waveform regions that are offset forward or backward by a preset time offset; performing cross-correlation analysis on each candidate waveform region and a preset reference waveform to obtain the cross-correlation degree of each candidate waveform region; and determining the offset sampling point corresponding to the candidate waveform region whose cross-correlation degree reaches the maximum peak value as the attack location point.
[0108] As one implementation method, the waveform region determination unit 302 is specifically configured to extract a preset reference waveform from the actual waveform generated during the execution of the block white-box cryptography algorithm, based on the execution path and preset waveform characteristics of the block white-box cryptography algorithm.
[0109] As one implementation method, the round recognition unit 301 is specifically configured such that the morphological features include an upward trend, a downward trend, periodicity, and waveform amplitude changes.
[0110] Regarding the apparatus in the above embodiments, the specific manner in which each unit module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.
[0111] Figure 6 This is a schematic diagram of an electronic device provided in this application. (For example...) Figure 6 The electronic device 60 may include at least one processor 601 and a memory 603 for storing processor-executable instructions. The processor 601 is configured to execute the instructions in the memory 603 to implement the attack location method for the block white-box cryptographic algorithm in the following embodiments.
[0112] In addition, the electronic device 60 may also include a communication bus 602, at least one communication interface 604, an input device 606, and an output device 605.
[0113] The processor 601 may be a processor (central processing unit, CPU), a microprocessor unit, an ASIC, or one or more integrated circuits for controlling the execution of the program of the present application.
[0114] The communication bus 602 may include a path for transmitting information between the aforementioned components.
[0115] Communication interface 604 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.
[0116] Input device 606 is used to receive input signals and output device 605 is used to output signals.
[0117] The memory 603 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed discs, laser discs, optical discs, digital universal discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. The memory may exist independently and be connected to the processing unit via a bus. The memory may also be integrated with the processing unit.
[0118] The memory 603 stores instructions for executing the scheme of this application, and the processor 601 controls the execution. The processor 601 executes the instructions stored in the memory 603 to realize the functions of the method of this application.
[0119] In a specific implementation, as one example, processor 601 may include one or more CPUs, for example... Figure 6 CPU0 and CPU1 in the CPU.
[0120] In a specific implementation, as one example, the electronic device 60 may include multiple processors, such as... Figure 6 Processors 601 and 607 are described herein. Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. A processor here may refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).
[0121] The electronic device is as follows Figure 6 The diagram includes a processor 601 and a memory 603 for storing executable instructions of the processor 601. The processor 601 is configured to execute the executable instructions to implement an attack location method for a block white-box cryptographic algorithm as described in any of the possible embodiments above. Furthermore, it achieves the same technical effect, and to avoid repetition, will not be elaborated further here.
[0122] This application also provides a computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by the processor of a block white-box cryptography attack location device or electronic device, the block white-box cryptography attack location device or electronic device is able to execute the block white-box cryptography attack location method as described in any of the above possible embodiments. And it can achieve the same technical effect; to avoid repetition, it will not be described again here.
[0123] This application also provides a computer program product, including a computer program or instructions, which are executed by a processor to perform an attack location method for a block white-box cryptographic algorithm as described in any of the possible implementations above. It achieves the same technical effect, and to avoid repetition, will not be described again here.
[0124] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.
[0125] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.
Claims
1. A method for locating attacks on block white-box cryptographic algorithms, characterized in that, The method includes: Real-time acquisition of side-channel waveforms generated during the execution of block white-box cryptography algorithms; The morphological characteristics of the side channel waveform are analyzed to determine the target rounds of the attack; From the actual side-channel waveforms generated in the target round, determine the target waveform region whose waveform difference from the preset reference waveform is less than the difference threshold; The attack location point is determined based on the target waveform region.
2. The method according to claim 1, characterized in that, The step of determining the target waveform region from the actual side-channel waveform generated in the target round, where the waveform difference from the preset reference waveform is less than a difference threshold, includes: According to the preset sampling step size and preset sampling number of the preset reference waveform, the actual sampled values of the preset sampling number are successively sampled from the actual side channel waveform, and the sum of the absolute differences between each actual sampled value and the corresponding preset sampled value in the preset sampling number is determined successively; the preset sampled value is the sampled value corresponding to the preset reference waveform at the preset sampling point of each preset sampling step size. The waveform region corresponding to the actual sampled value of the preset number of samples where the sum of the absolute differences is less than the first difference threshold is determined as the target waveform region.
3. The method according to claim 1, characterized in that, The step of determining the target waveform region from the actual side-channel waveform generated in the target round, where the waveform difference from the preset reference waveform is less than a difference threshold, includes: According to the preset sampling step size and preset sampling number of the preset reference waveform, the actual sampled values of the preset sampling number are sampled successively from the actual side channel waveform, and the square mean of the difference between each actual sampled value and the corresponding preset sampled value is determined successively. The waveform region corresponding to the actual sampled value of the preset number of samples for which the mean square of the difference is less than the second difference threshold is determined as the target waveform region.
4. The method according to claim 1, characterized in that, Determining the attack location point based on the target waveform region includes: The starting point, center point, or falling edge point in the target waveform region is determined as the attack location point.
5. The method according to claim 1, characterized in that, Determining the attack location point based on the target waveform region includes: On the actual side channel waveform, with the target waveform region as the offset center, multiple candidate waveform regions are successively acquired that are offset forward or backward by a preset time offset. Perform cross-correlation analysis between each candidate waveform region and the preset reference waveform to obtain the cross-correlation degree of each candidate waveform region; The offset sampling point corresponding to the candidate waveform region where the cross-correlation reaches its maximum peak value is determined as the attack location point.
6. The method according to claim 1, characterized in that, The method further includes: Based on the execution path and preset waveform characteristics of the block white-box cryptography algorithm, the preset reference waveform is extracted from the actual waveforms generated during the execution of the block white-box cryptography algorithm.
7. The method according to claim 1, characterized in that, The morphological characteristics include upward trend, downward trend, periodicity, and waveform amplitude variation.
8. An attack location device for block white-box cryptography algorithms, characterized in that, The device includes: The round identification unit is configured to collect side-channel waveforms generated during the execution of the block white-box cryptography algorithm in real time; analyze the morphological characteristics of the side-channel waveforms to determine the target round of the attack; The waveform region determination module is configured to determine a target waveform region from the actual side-channel waveform generated in the target round, wherein the waveform difference from the preset reference waveform is less than a difference threshold. The attack location determination module is configured to determine the attack location based on the target waveform region.
9. An attack location system for block white-box cryptography algorithms, characterized in that, The attack localization system for the block white-box cryptography algorithm includes a first-level state round identification module, a second-level state behavior matching and fine-grained localization module, and a third-level state high-precision verification module; the first-level state round identification module, the second-level state behavior matching and fine-grained localization module, and the third-level state high-precision verification module are connected through communication; The first-level state round identification module is configured to collect side-channel waveforms generated in real time during the execution of the block white-box cryptography algorithm; The secondary state behavior matching and fine-grained positioning module is configured to determine the target waveform region from the actual side channel waveform generated in the target round, whose waveform difference from the preset reference waveform is less than the difference threshold. The three-level state high-precision verification module is configured to, on the actual side channel waveform, take the target waveform region as the offset center, and successively acquire multiple candidate waveform regions that are offset forward or backward by a preset time offset; perform cross-correlation analysis on each candidate waveform region and the preset reference waveform to obtain the cross-correlation degree of each candidate waveform region; The offset sampling points corresponding to the candidate waveform regions where the cross-correlation reaches its maximum peak value are determined as the attack location points; The system is configured to perform an attack location method for the block white-box cryptographic algorithm as described in any one of claims 1-7.
10. A computer-readable storage medium storing instructions thereon, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is able to perform the attack location method of the block white-box cryptographic algorithm as described in any one of claims 1-7.