Side channel attack preventing apparatus, method and electronic apparatus using the same

Abstract

A side-channel attack prevention device is installed in an electronic device or testing device and includes a controller and a machine learning module. When the sensitive data processing device and / or encryption / decryption device of the electronic device are running, the controller changes the power waveform of the electronic device using a power waveform adjustment method. The machine learning module is electrically connected to the controller. When the encryption / decryption device and / or sensitive data processing device of the electronic device are running, it acquires the power waveform and uses a trained machine learning model to determine the confidence level of the power waveform having specific characteristics. The power waveform adjustment method is selected by the controller from among several previously unselected power waveform adjustment methods. If the confidence level is greater than or equal to a threshold value, the controller again selects one from among the previously unselected power waveform adjustment methods.

Description

Technical Field

[0001] This invention relates to a side-channel attack prevention technique to prevent hackers from performing power analysis and thus carrying out side-channel attacks, and more particularly to a side-channel attack prevention device, method, and electronic device using the same, which uses a machine learning model to determine whether the power waveform of an electronic device may have specific characteristics when the device is performing encryption, decryption, or sensitive data processing. Prior Technology

[0002] To enhance the security of data storage within a chip (i.e., data encryption) or for secure data exchange with external systems, implementing encryption algorithms within the chip is a common practice. A common example is the Advanced Encryption Standard (AES). Because these algorithms have been around for many years, they have been extensively studied by individuals (such as academics and hackers). For instance, the power consumption characteristics of AES during operation are widely understood. Therefore, malicious individuals (such as hackers) can potentially deduce the key used by AES by collecting extensive data on these power consumption characteristics, thereby achieving the goal of stealing sensitive information. These attack methods are collectively known as side-channel attacks.

[0003] Side-channel attacks succeed because the algorithm is fixed, and the power consumption of each operation within the algorithm generally exhibits specific characteristics. Therefore, with enough data, it's possible to crack the key. To counter side-channel attacks, some have proposed adding unnecessary dummy operations to the original AES computation or repeatedly executing the original operations to disrupt hackers' ability to derive the key through power consumption analysis. While these methods can disrupt analysis, they incur additional hardware costs. Furthermore, since the added hardware is fixed, the resulting additional power consumption is also fixed (i.e., the interference is fixed). Therefore, with advancements in analysis tools, it's questionable whether these methods will remain effective in protecting the key in the future. Summary of the Invention

[0004] As can be understood from the above description, the purpose of this invention is to provide a side-channel attack prevention device, method, electronic device using the same, and testing device that makes it difficult for malicious individuals to determine the operation of an encryption / decryption device and / or a sensitive data processing device by collecting a large amount of power consumption characteristics.

[0005] Based on one objective of this invention, embodiments of the invention provide a side-channel attack prevention device, which is disposed in an electronic device or a testing device and includes a controller and a machine learning module. The controller is used to change the power waveform of the electronic device using a power waveform adjustment method when the sensitive data processing device and / or encryption / decryption device of the electronic device is running. The machine learning module is electrically connected to the controller and is used to acquire the power waveform when the encryption / decryption device and / or sensitive data processing device of the electronic device is running, and to use a trained machine learning model to determine the confidence level of the power waveform having specific characteristics. The power waveform adjustment method is set by the user, and when the confidence level is greater than or equal to a threshold value, the controller prompts the user to reset the power waveform adjustment method; alternatively, the power waveform adjustment method is selected by the controller from among several previously unselected power waveform adjustment methods, and when the confidence level is greater than or equal to the threshold value, the controller reselects one from among several previously unselected power waveform adjustment methods.

[0006] Based on one objective of the present invention, embodiments of the present invention provide an electronic device, comprising an encryption / decryption device and / or a sensitive data processing device, a plurality of hardware devices, a power conversion device, a controller, and a machine learning module. The power conversion device is electrically connected to the encryption / decryption device and / or the sensitive data processing device and the plurality of hardware devices, and is used to receive power signals and convert the power signals to generate a supply voltage or supply current. The controller is electrically connected to the power conversion device, the encryption / decryption device and / or the sensitive data processing device, and the plurality of hardware devices, and is used to change the power waveform of the electronic device corresponding to the power signal using a power waveform adjustment method when the sensitive data processing device and / or the encryption / decryption device is operating. The machine learning module is electrically connected to the controller and the power conversion device, and is used to acquire the power waveform when the encryption / decryption device and / or the sensitive data processing device of the electronic device is operating, and to use a trained machine learning model to determine the confidence level of the power waveform having specific characteristics. The power waveform adjustment method is set by the user, and when the confidence level is greater than or equal to a threshold value, the controller prompts the user to reset the power waveform adjustment method. Alternatively, the power waveform adjustment method is selected by the controller from a plurality of previously unselected power waveform adjustment methods, and when the confidence level is greater than or equal to the threshold value, the controller reselects from a plurality of previously unselected power waveform adjustment methods. The power waveform adjustment method involves at least one of a plurality of hardware devices of the electronic device being turned on or off at different times during the operation of the sensitive data processing device or encryption / decryption device, or at least one of a plurality of hardware devices of the electronic device adjusting its operating voltage, operating current, or operating frequency at different times during the operation of the sensitive data processing device or encryption / decryption device.

[0007] Based on one objective of the present invention, an embodiment of the present invention provides a side-channel attack prevention method, which is executed in an electronic device or a testing device, and includes the following steps: using a power waveform adjustment method to change the power waveform of the electronic device while the sensitive data processing device and / or encryption / decryption device of the electronic device are running via a controller; using a machine learning module to acquire the power waveform while the encryption / decryption device and / or sensitive data processing device of the electronic device are running, and using a trained machine learning model to determine the confidence level of the power waveform having specific characteristics; and the power waveform adjustment method is set by the user, and when the confidence level is greater than or equal to a threshold value, the controller prompts the user to reset the power waveform adjustment method; or, the power waveform adjustment method is selected by the controller from among several previously unselected power waveform adjustment methods, and when the confidence level is greater than or equal to the threshold value, the controller reselects one from among several previously unselected power waveform adjustment methods.

[0008] As described above, compared to prior art, the side-channel attack prevention device, method, and electronic device using the present invention can ensure that malicious individuals cannot determine the operation of the encryption / decryption device and / or sensitive data processing device by collecting large amounts of power consumption characteristics, thereby increasing the security of the electronic device and preventing the theft or damage of keys or sensitive data. Furthermore, the electronic device provided by the present invention requires no additional hardware beyond the addition of a machine learning module; therefore, compared to prior art, it can reduce hardware setup costs and may even effectively reduce unnecessary power consumption. Simple Explanation of the Diagram

[0009] Figure 1A is a block diagram of an electronic device with a side-channel attack prevention device according to an embodiment of the present invention. Figure 2 shows the original power waveform of the electronic device during operation of the encryption / decryption device and / or sensitive data processing device of the electronic device according to an embodiment of the present invention. Figure 3 shows the adjusted power waveform of the electronic device during operation of the encryption / decryption device and / or sensitive data processing device of the electronic device according to an embodiment of the present invention. Figure 4 is a flowchart of the side-channel attack prevention method according to an embodiment of the present invention. Implementation

[0010] The primary objective of this invention is to provide a side-channel attack prevention device, method, and electronic device using the same, which ensures that malicious actors cannot determine the operation of encryption / decryption devices and / or sensitive data processing devices by collecting large amounts of power consumption characteristics. To achieve this objective, the side-channel attack prevention device, method, and electronic device using the same provided by this invention can, before leaving the factory or in a secure environment (e.g., an unconnected environment or other environments where malicious actors cannot obtain power waveforms), use a machine learning model to determine the reliability of the power waveform of the electronic device during the operation of the sensitive data processing device and / or encryption / decryption device by identifying specific characteristics.

[0011] If the confidence level is greater than or equal to the threshold value, another power waveform adjustment method is applied during the operation of the sensitive data processing device and / or encryption / decryption device to change the confidence level of the power waveform with specific characteristics until the confidence level is less than the threshold value. When the confidence level of the power waveform of the electronic device during the operation of the sensitive data processing device and / or encryption / decryption device is less than the threshold value, it means that it is difficult for a malicious person to know that the encryption / decryption device and / or sensitive data processing device is running by collecting a large amount of power consumption characteristics.

[0012] The following will describe in detail the possible embodiments of the present invention with reference to the accompanying drawings. However, it should be noted that the following implementation details are not intended to limit the scope of the patent claims made by the present invention, but are merely for the convenience of those skilled in the art to understand.

[0013] First, please refer to Figure 1, which is a block diagram of an electronic device with a side-channel attack prevention device according to an embodiment of the present invention. The electronic device includes an encryption / decryption device 103 and / or a sensitive data processing device 104, a plurality of hardware devices 105-107, a power conversion device 108, a controller 102, and a machine learning module 101. The power conversion device 108 is electrically connected to the encryption / decryption device 103 and / or the sensitive data processing device 104, the plurality of hardware devices 105-107, the controller 102, and the machine learning module 101, and the controller 102 is electrically connected to the encryption / decryption device 103 and / or the sensitive data processing device 104, the plurality of hardware devices 105-107, and the machine learning module 101.

[0014] The side-channel attack prevention device of the present invention mainly comprises a controller 102 and a machine learning module 101. The controller 102 is used to change the power waveform of the electronic device using a power waveform adjustment method when the sensitive data processing device 104 and / or encryption / decryption device 103 of the electronic device are running. The machine learning module 101 is electrically connected to the controller and is used to acquire the power waveform when the sensitive data processing device 104 and / or encryption / decryption device 103 of the electronic device are running, and to use a trained machine learning model to determine the credibility of the power waveform having specific characteristics. Further, the aforementioned machine learning model can be at least one of Support Vector Machine (SVM), forward neural network, recurrent neural network (RNN), convolutional neural network (CNN), gated recurrent unit (GRU), and long-short-term memory (LSTM).

[0015] In one implementation, the power waveform adjustment method is set by the user, for example, by issuing a command to the controller 102 to set the power waveform adjustment method (i.e., manually setting the power waveform adjustment method). At this time, when the confidence level is greater than or equal to a threshold value, the controller 102 will prompt the user to reset the power waveform adjustment method. For example, the controller 102 will output a result indicating that the confidence level is greater than or equal to the threshold value to inform the user. Then, after resetting the power waveform adjustment method, when the sensitive data processing device 104 and / or encryption / decryption device 103 subsequently run, the machine learning module 101 again uses the machine learning model to determine the confidence level of the power waveform with specific characteristics. If the confidence level is less than the threshold value, the controller 102 will prompt the user that the currently set power waveform adjustment method can be applied when the sensitive data processing device 104 and / or encryption / decryption device 103 subsequently run.

[0016] In another implementation, the power waveform adjustment method is selected by the controller 102 from among several previously unselected power waveform adjustment methods (i.e., automatic selection of the power waveform adjustment method). In this case, if the confidence level is greater than or equal to a threshold value, the controller 102 again selects one from among the several previously unselected power waveform adjustment methods. If the confidence level is less than the threshold value, the controller 102 records the selected power waveform adjustment method, for example, by writing the power waveform adjustment method to non-volatile memory. Later, when the sensitive data processing device 104 and / or the encryption / decryption device 103 are running, the controller reads the recorded power waveform adjustment method from the non-volatile memory and uses the recorded power waveform adjustment method to change the power waveform.

[0017] The power conversion device 108 receives and converts power signals to generate a supply voltage or current for the encryption / decryption device 103 and / or the sensitive data processing device 104, multiple hardware devices 105-107, the controller 102, and the machine learning module 101. The power waveform corresponding to the power signal can be a voltage waveform, a current waveform, or a power consumption waveform. Furthermore, the specific characteristics of the power waveform can be its time-domain and / or frequency-domain characteristics.

[0018] The encryption / decryption device 103 may be, for example, but is not limited to, an AES encryption / decryption device. However, it could also be an RSA encryption algorithm encryption / decryption device, or any other encryption / decryption device whose operation can be known through side-channel attacks. In short, this invention is not limited to the type of encryption / decryption device 103. The sensitive data processing device 104 may be another encryption / decryption device, an encrypted data storage device, or another device for processing sensitive data. When processing sensitive data, the sensitive data processing device 104 may also cause the power waveform corresponding to the power signal of the electronic device to have specific characteristics.

[0019] In order to make the power waveform of the encryption / decryption device 103 and / or the sensitive data processing device 104 difficult to observe with specific characteristics, the controller 102 of the present invention controls at least one of the plurality of hardware devices 105-107 to turn on or off at different times during the operation of the sensitive data processing device 104 or the encryption / decryption device 103, according to the power waveform adjustment mode set by the user or selected by the controller 102, or controls at least one of the plurality of hardware devices 105-107 to adjust its operating voltage, operating current or operating frequency at different times during the operation of the sensitive data processing device 104 or the encryption / decryption device 103.

[0020] Once a confidence level below a threshold is identified that allows the power waveform to exhibit specific characteristics, the corresponding power waveform adjustment method can be applied to the subsequent operation of the encryption / decryption device 103 and / or the sensitive data processing device 104, thereby achieving the purpose of preventing side-channel attacks. Furthermore, the hardware devices 105-107 are not additional hardware devices added to the electronic device, but are inherent to the electronic device itself. Therefore, unlike prior art, which requires additional hardware devices, the present invention can effectively reduce hardware setup costs.

[0021] Please refer to Figures 1-3. Figure 2 shows the original power waveform of the electronic device during operation of the encryption / decryption device and / or sensitive data processing device according to an embodiment of the present invention, and Figure 3 shows the adjusted power waveform of the electronic device during operation of the encryption / decryption device and / or sensitive data processing device according to an embodiment of the present invention. In Figure 2, the original power waveform 201 of the electronic device during operation of the encryption / decryption device 103 and / or sensitive data processing device 104 has specific characteristics, making it easy for a person with a discerning eye to analyze and determine that the encryption / decryption device 103 and / or sensitive data processing device 104 are operating. After applying the power waveform adjustment method found through the machine learning model, as shown in Figure 3, the power waveform of the electronic device during operation of the encryption / decryption device 103 and / or the sensitive data processing device 104 is a combination of power waveform 201 and power waveforms 302-307. Among them, power waveforms 302, 304 and 305 are the power waveforms contributed when the hardware device 105 is turned on, power waveforms 302 and 306 are the power waveforms contributed when the hardware device 106 is turned on, and power waveform 307 is the power waveform contributed when the hardware device 107 is turned on.

[0022] Please refer to Figures 1 and 4. Figure 4 is a flowchart of the side-channel attack prevention method according to an embodiment of the present invention. First, in step S301, the controller 102 selects one of the previously unselected power waveform adjustment methods from a plurality of power waveform adjustment methods, and uses the selected power waveform adjustment method to change the power waveform of the electronic device when the sensitive data processing device 104 or the encryption / decryption device 103 is running. Then, in step S302, the machine learning module 101 obtains the power waveform of the electronic device when the sensitive data processing device 104 or the encryption / decryption device 103 is running. Next, in step S303, the machine learning module 101 uses a trained machine learning model to determine the confidence level of the power waveform having specific characteristics. In step S304, the controller 102 determines whether the confidence level is greater than or equal to a threshold value. If the confidence level is greater than or equal to the threshold value, step S301 is executed, and one of the previously unselected power waveform adjustment methods is reselected; if the confidence level is less than the threshold value, step S305 is executed. In step S305, the selected power waveform adjustment method is recorded by the controller 102, and the recorded power waveform adjustment method is used to change the power waveform when the sensitive data processing device 104 or the encryption / decryption device 103 is running.

[0023] Please note that the side-channel attack prevention method in Figure 4 is illustrated using the controller 102 automatically selecting the power waveform adjustment mode as an example. However, as mentioned above, in one embodiment, the power waveform adjustment mode can also be manually set. In the case of manually setting the power waveform adjustment mode, step S301 becomes: when the sensitive data processing device 104 or the encryption / decryption device 103 is running, the set power waveform adjustment mode is used to change the power waveform of the electronic device. Step S305 becomes: prompting the user that the currently set power waveform adjustment mode can be applied to the subsequent operation of the sensitive data processing device 104 and / or the encryption / decryption device 103.

[0024] Please note that in the above embodiments, the controller 102 and the machine learning module 101 are located in an electronic device, but this is not a limitation of the present invention. In other embodiments, the controller 102 and the machine learning module 101 are located in a test device, and the electronic device has another controller electrically connected to the controller 102, the encryption / decryption device 103 and / or the sensitive data processing device 104, and a plurality of hardware devices 105-107. The controller 102 of the test device is used to communicate with the controller of the electronic device, and the test device can find a suitable power waveform adjustment mode for the electronic device during the testing phase. This allows the controller of the electronic device to use the suitable power waveform adjustment mode found by the controller 102 of the test device when the encryption / decryption device 103 and / or the sensitive data processing device 104 of the electronic device are running, thereby preventing side-channel attacks.

[0025] In summary, the side-channel attack prevention device, method, and electronic device using the present invention have the following characteristics: (1) A machine learning model is used to determine whether the specific characteristics of the power waveform of the electronic device are obvious. If obvious, it means that the electronic device is easily compromised by a side-channel attack and its key or sensitive data is easily obtained. If the selected power waveform adjustment method makes the machine learning model know that the specific characteristics of the power waveform are not obvious, it means that the electronic device is difficult to compromise by a side-channel attack and its key or sensitive data is difficult to obtain. (2) The machine learning model can be updated so that the interpretation capability keeps pace with the times. (3) Previous technologies used additional hardware devices to create a cover. Function, but because the ability to mask the function is fixed, it is not flexible. However, the method of using machine learning models in this invention is more flexible and has a better chance of resisting unknown attack forms; (4) Although additional hardware devices can be added to the electronic device in this invention, and the hardware devices can be turned on to mask the power waveform when needed, it is better not to add additional hardware devices, but to turn on the existing hardware devices of the electronic device to save hardware costs; (5) In this invention, the power waveform adjustment method of turning on those hardware devices to mask the power waveform can be manually set, or the controller can select it by itself, or even another machine learning model can be introduced to select it automatically.

[0026] This invention is disclosed herein only by preferred embodiments. However, it should be understood by anyone skilled in the art that the above embodiments are for illustrative purposes only and are not intended to limit the scope of the patent rights claimed by this invention. Any variations or substitutions that are equivalent to or equivalent to the above embodiments should be interpreted as being covered within the spirit or scope of this invention. Therefore, the scope of protection of this invention should be based on the claims defined below.

[0027] 101: Machine Learning Module 102: Controller 103: Encryption / decryption device 104: Sensitive Data Processing Device 105~107: Hardware 108: Power conversion device 201, 302~307: Power supply waveforms S301~S305: Steps

Claims

1. A side-channel attack prevention device, disposed in an electronic device or a testing device, comprising: A controller is configured to change a power waveform of the electronic device using a power waveform adjustment method when a sensitive data processing device and / or an encryption / decryption device of the electronic device is running; and a machine learning module is electrically connected to the controller, configured to acquire the power waveform when the encryption / decryption device and / or the sensitive data processing device of the electronic device is running, and to use a trained machine learning model to determine the confidence level of the power waveform having a specific characteristic; wherein the power waveform adjustment method is set by a user, and when the confidence level is greater than or equal to a threshold value, the controller prompts the user to reset the power waveform adjustment method; or, the power waveform adjustment method is selected by the controller from a plurality of power waveform adjustment methods that have not been previously selected, and when the confidence level is greater than or equal to the threshold value, the controller reselects from the plurality of power waveform adjustment methods that have not been previously selected.

2. The side-channel attack prevention device as claimed in claim 1, wherein the power waveform adjustment method is one of the power waveform adjustment methods previously not selected by the controller, and when the confidence level is less than the threshold value, the controller records the selected power waveform adjustment method, and subsequently, when the sensitive data processing device and / or the encryption / decryption device are running, the electronic device uses the recorded power waveform adjustment method to change the power waveform.

3. The side-channel attack prevention device as claimed in claim 1, wherein the power waveform adjustment method is to turn on or off at least one hardware device of the electronic device at different times during the operation of the sensitive data processing device or the encryption / decryption device, or to adjust an operating voltage, an operating current or an operating frequency of at least one hardware device of the electronic device at different times during the operation of the sensitive data processing device or the encryption / decryption device.

4. The side-channel attack prevention device as claimed in claim 1, wherein the power supply waveform is a voltage waveform, a current waveform, or a power consumption waveform, and the specific feature is a time-domain feature and / or a frequency-domain feature of the power supply waveform.

5. The side-channel attack prevention device as claimed in claim 1, wherein the electronic device includes the machine learning module and the controller; or, the electronic device does not include the machine learning module and the controller, and the machine learning module and the controller are disposed in the test device outside the electronic device.

6. An electronic device comprising: An encryption / decryption device and / or a sensitive data processing device; Multiple hardware devices; A power conversion device, electrically connected to the encryption / decryption device and / or the sensitive data processing device and the plurality of hardware devices, is configured to receive a power signal and convert the power signal to generate a supply voltage or a supply current; a controller, electrically connected to the power conversion device, the encryption / decryption device and / or the sensitive data processing device and the plurality of hardware devices, is configured to change a power waveform of the electronic device corresponding to the power signal using a power waveform adjustment method when the sensitive data processing device and / or the encryption / decryption device is running; and a machine learning module, electrically connected to the controller and the power conversion device, is configured to acquire the power waveform when the encryption / decryption device and / or the sensitive data processing device of the electronic device is running, and use a trained machine learning model to determine the confidence level of the power waveform having a specific characteristic; The power waveform adjustment method is set by a user, and when the confidence level is greater than or equal to the threshold value, the controller prompts the user to reset the power waveform adjustment method. Alternatively, the power waveform adjustment method is selected by the controller from a plurality of power waveform adjustment methods that have not been previously selected, and when the confidence level is greater than or equal to the threshold value, the controller reselects from the plurality of power waveform adjustment methods that have not been previously selected. The power waveform adjustment method is that at least one of the plurality of hardware devices of the electronic device is turned on or off at different times during the operation of the sensitive data processing device or the encryption / decryption device. Alternatively, at least one of the plurality of hardware devices of the electronic device adjusts an operating voltage, an operating current, or an operating frequency at different times during the operation of the sensitive data processing device or the encryption / decryption device.

7. The electronic device as claimed in claim 6, wherein the machine learning model is at least one of a support vector machine, a feedforward neural network, a recursive neural network, a convolutional neural network, a gated recurrent unit, and a long short-term memory network.

8. The electronic device of claim 6, wherein the power waveform adjustment mode is one of the power waveform adjustment modes previously not selected by the controller, and the recorded power waveform adjustment mode is written by the controller into a non-volatile memory.

9. A side-channel attack prevention method, implemented in an electronic device or a testing device, comprising: A controller, during the operation of a sensitive data processing device and / or an encryption / decryption device in the electronic device, uses a power waveform adjustment method to change a power waveform of the electronic device; a machine learning module, during the operation of the encryption / decryption device and / or the sensitive data processing device in the electronic device, acquires the power waveform and uses a trained machine learning model to determine the confidence level of the power waveform having a specific characteristic; and the power waveform adjustment method is set by a user, and when the confidence level is greater than or equal to the threshold value, the controller prompts the user to reset the power waveform adjustment method, or the power waveform adjustment method is selected by the controller from among a plurality of previously unselected power waveform adjustment methods, and when the confidence level is greater than or equal to the threshold value, the controller reselects from among the plurality of previously unselected power waveform adjustment methods.

10. The side-channel attack prevention method as claimed in claim 9, wherein the power waveform adjustment mode is one of the power waveform adjustment modes previously not selected by the controller, and the recorded power waveform adjustment mode is written by the controller into a non-volatile memory.

Images