A Power Analysis Attack Resistance Method Based on Random S-Box Masking
By splitting the S box of the AES algorithm into two parts, s0 and s1, and performing reorganization and XOR operations, the problem of low area and throughput of the existing masking scheme is solved, and more efficient anti-side channel attack protection is achieved.
Patent Information
- Application Number
- CN202211434657.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-11-16
- Publication Date
- 2025-08-01
- Estimated Expiration
- 2042-11-16
AI Technical Summary
The existing masking schemes have problems with large area overhead and low throughput when protecting against high-order attacks, and are difficult to withstand high-order attacks.
The random S-box masking scheme is adopted, and the S-box is split into two parts, s0 box and s1 box, and a pseudo-intermediate value is generated through reorganization and XOR operations, increasing the difficulty of attack and reducing power consumption and area overhead.
It effectively reduces the area and power consumption overhead of the random S-box solution, and improves the protection ability against power-consuming attacks, especially in FPGA and ASIC environments.
Smart Images
Figure CN115765967B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to a protection scheme based on front-end mask design, belonging to the technical field of information security chip design. Background Art
[0002] With the rapid development of the Internet of Things (IoT), information exchange has become an integral part of our daily lives. This has also brought with it numerous security issues. Cryptographic algorithms are a key means of securing IoT information exchange. Block ciphers are currently the most common and widely used encryption algorithms. Cryptographically secure information exchange also carries the risk of being compromised. The most common attack vector is side-channel attacks, which exploit side-channel information such as the power consumption of the cryptographic chip during encryption to compromise the encryption key. Therefore, security protection against side-channel attacks has become particularly important. Masking is a commonly used defense against side-channel attacks. By randomizing intermediate values during the encryption process, attackers cannot determine the specific intermediate values and mathematically determine the relationship between the correct intermediate values and the measured power consumption, thereby preventing them from deriving the correct key. However, existing masking schemes suffer from significant area overhead, throughput, and performance limitations. The SDRR protection scheme requires two cycles to complete each encryption round, reducing encryption throughput and failing to protect against advanced side-channel attacks. Nikova et al. proposed a hidden encryption mask protection scheme that can resist first-order differential power consumption attacks, but the area overhead after protection increased by 3-12 times. Yi Wang et al. optimized the masking technology in FPGA-based encryption, but compared with the unprotected encryption scheme, the FPGA resource utilization was doubled. Roben et al. introduced a random number before the AES encryption operation, making the encryption key a pseudo-key. By adding an iterative masking scheme, the final output was the correct ciphertext. However, if the mask is known, the pseudo-key still poses a significant risk of being cracked. Therefore, it is necessary to design a reasonable anti-power consumption attack scheme to reduce resource overhead and achieve efficient implementation. Summary of the Invention
[0003] Technical problem: In response to the above problems, the present invention proposes a method for resisting power consumption attacks based on random S-box masking, which is a new masking scheme to resist side-channel attacks. It not only makes the intermediate value of the encryption algorithm and the power consumption value no longer have a strong relationship, increasing the difficulty of side-channel attacks, but also compared with previous masking schemes, the area and power consumption performance have been greatly improved.
[0004] Technical solution: A method for resisting power consumption attacks based on random S-box masking of the present invention comprises the following steps:
[0005] Step 1: Generate a random number n as the basis for splitting the S-box. The value range of n is from 1 to 15. Split the S-box into two parts, namely 16×n and 16×(16 - n).
[0006] Step 2: Recombine the two newly generated S-boxes. Fix the upper half of the 16×n part, and fill the remaining part with the S-box unit address information to form a new 16×16 s0 box. Similarly, fix the lower half of the 16×(16 - n) part, and fill the upper half with the S-box unit address information to form a 16×16 s1 box.
[0007] Step 3: For each group of data, if the data is less than 16×n, a permutation can occur; otherwise, the data remains unchanged. The flag bit of the permuted data is marked as 1, and the unpermuted data is marked as 0. The flag bits of each group of data form a 16-bit marker data.
[0008] Step 4: Take the first 8 bits of the marker data and perform exclusive OR with each group of 8-bit data in turn to generate a pseudo-intermediate value. In the next clock cycle, store the pseudo-intermediate value and the marker data in the register.
[0009] Step 5: In the next clock cycle, take out the stored pseudo-intermediate value and the marker data, and perform exclusive OR on the pseudo-intermediate value and the first 8 bits of the marker data again to restore the original intermediate value.
[0010] Step 6: Replace the restored intermediate value with the s1 box to complete the overall permutation of the S-box and improve the chip's ability to resist side-channel attacks.
[0011] For the recombination of the two newly generated S-boxes, before and after accessing data based on the register, the S-box replacement operation before storing in the register is divided into two parts to jointly complete the S-box replacement operation. The first part completes the replacement of part of the data, and the latter part completes the replacement of the remaining data, which are respectively placed before storing in the register and after taking out. These two parts are completed by the new S-box composed of the s0 box and the s1 box, where the s0 box and the s1 box are formed by randomly decomposing and recombining the original S-box.
[0012] The s0 box mentioned above is composed of the 16×n part of the disassembled S-box and the 16×(16 - n) filled with address information, while the s1 box is composed of the 16×(16 - n) part of the disassembled S-box and the 16×n part filled with address information.
[0013] The replacement of the s0 box is to replace the data of each group less than 16×n, while the data greater than 16×n remains unchanged.
[0014] Before storing data into the register, the data to be replaced is marked as 1, and the data that is not replaced is marked as 0. At the same time, the marked data is XORed with the data after the s0 replacement to generate a pseudo-intermediate value.
[0015] After retrieving data from the register, the stored pseudo-intermediate value is XORed with the marked data again to restore the data after the original s0 replacement.
[0016] The s1 box replacement is obtained by replacing the restored data with the s1 box data. Data greater than 16×n is replaced, and data less than 16×n remains unchanged, finally completing the overall replacement.
[0017] Beneficial effects: The present invention proposes a mask protection scheme based on a random S box, which effectively reduces power consumption, area overhead, and improves the protection ability against power consumption attacks. Compared with the prior art, since only the original S box is disassembled without introducing additional sub-modules, the area overhead of the random S box-based scheme is relatively small. Among them, the area overhead of the random S box of SKINNY in the FPGA environment is about 10%; the area overhead of the random S box of AES in the ASIC is about 5%. At the same time, because the replacement of the original S box is split into two steps and its power consumption remains almost unchanged, the power consumption overhead of the random S box-based scheme is relatively small. Among them, the power consumption overhead of the random S box of SKINNY in the FPGA environment is about 3%; the power consumption overhead of the random S box of AES without XOR of the marked data is about 2%. Therefore, the mask-based random S box protection scheme has better protection performance and has not been broken in both the FPGA and EDA environments.
[0018] In summary, the mask protection scheme can achieve good protection performance, and both the area and power consumption overhead are smaller than the existing protection schemes. Brief Description of the Drawings
[0019] Figure 1 is a schematic diagram of the disassembly and recombination process of the random S box;
[0020] Figure 2 is a schematic diagram of the access of the intermediate value register and the reading of the marked data;
[0021] Figure 3 is a schematic diagram of the scheme for accessing the intermediate value register and XORing the marked data;
[0022] Figure 4 is a flow chart of the present invention. Detailed Embodiments
[0023] The technical solutions of the present invention will be further described below with reference to the drawings and embodiments.
[0024] As Figure 1As shown below, the specific process for generating a random S-box for the AES128 algorithm of the present invention is as follows:
[0025] The S-box substitution table of the traditional AES block cipher algorithm is a 16×16 lookup table. According to the value of the input data, the corresponding value is looked up, which is a non-linear transformation. The first step of the random S-box protection scheme is to split the S-box. Taking n = 5 as an example, the S-box is split into two parts, namely 16×5 and 16×(16 - 5). After completing the splitting work, the two newly generated parts need to be recombined. First, the upper half of the 16×5 is fixed, and the remaining 16×(16 - 5) part is filled to form a new s0 box. The filling content of the remaining 16×(16 - 5) part is the S-box unit address information, that is, its substitution value is also the substitution number itself and remains unchanged. This part is used as the operation before storing in the register. Secondly, for the lower half of the original S-box decomposition, that is, the 16×(16 - 5) part, the upper half needs to be filled to generate a new s1 box. The filling part is the same as the filling scheme of the s0 box. This s1 box is used for the substitution operation that needs to be performed after taking out from the register. Finally, through the substitution operations of s0 and s1, the substitution purpose of the S-box is jointly completed, and the correct intermediate value generated continues the next operation.
[0026] As Figure 2 shown, after completing the substitution operation of s0, the value needs to be marked. The data participating in the S-box substitution is 128 bits. The essence of the AES block is to disassemble it into 16 groups of 8-bit data for individual substitution. Therefore, for each group of data, if the data before the S-box substitution is less than 16×5, the substitution can be completed, otherwise it is the original value. At this time, the data that has undergone substitution needs to be marked. The marked value is 16-bit data, and each bit of this marked data represents 16 groups of data of the AES block. When this group undergoes substitution, the marked data is set to 1, otherwise it is set to 0. The register intermediate value generated at this time is called a semi-finished intermediate value, and partial substitution is completed. After completing this operation, the generated 128-bit intermediate value and 16-bit marked data are stored in the register. When the next clock arrives, the intermediate value and the marked data are taken out for the substitution of s1. At this time, the number of bits with the marked data of 0 represents the data that did not undergo substitution last time, that is, the data greater than or equal to 16×5. These data undergo substitution in s1 to complete the overall substitution. At this time, through the step-by-step substitution of the two S-boxes s0 and s1, the non-linear byte substitution intermediate value of the AES algorithm has been completed. The 128-bit random number stored in the register is a semi-finished product, so it increases the difficulty of calculating the Hamming distance.
[0027] As Figure 3As shown in the figure, for the characteristics of block ciphers, taking the first group of data as an example, when the permuted data is less than 16×5, there is a possibility of calculating the correct Hamming distance change. Therefore, the present invention proposes a scheme of attempting to XOR the marked data with the 128-bit intermediate value during the process. After completing the s0 permutation and the generation of the marked data, the first 8 bits of the marked data are taken and XORed with 16 groups of 128-bit data in turn to generate a completely unpredictable 128-bit intermediate value. At this time, even for two adjacent encryption rounds, due to the existence of the XOR scheme, the calculation scheme of the Hamming distance is difficult to attack. When the clock arrives, the 128-bit XOR semi-finished intermediate value and the 16-bit marked value are stored in the register. When the next clock arrives, the value is taken out and XORed again to restore the original semi-finished intermediate value, and the s1 permutation is performed again.
Claims
1. A power consumption attack resistant method based on a random S-box mask, characterized in that, The method includes the following steps: Step 1: Generate a random number n as the basis for splitting the S-box. The value range of n is from 1 to 15. Split the S-box into two parts, namely 16×n and 16×(16 - n); Step 2: Recombine the two newly generated S-boxes. Fix the upper half of 16×n, and fill the remaining part with the S-box unit address information to form a new 16×16 s0 box. Similarly, fix the lower half of 16×(16 - n), and fill the upper half with the S-box unit address information to form a 16×16 s1 box; Step 3: For each group of data, if the data is less than 16×n, a permutation can occur, otherwise the data remains unchanged; the permuted data is marked with 1, and the unpermuted data is marked with 0. The mark bits of each group of data form a 16-bit mark data; Step 4: Take the first 8 bits of the mark data and perform exclusive OR with each group of 8-bit data in turn to generate a pseudo intermediate value, and store the pseudo intermediate value and the mark data in the register in the next clock cycle; Step 5: In the next clock cycle, take out the stored pseudo intermediate value and the mark data, and perform exclusive OR on the pseudo intermediate value and the first 8 bits of the mark data again to restore the original intermediate value; Step 6: Replace the restored intermediate value with the s1 box to complete the overall replacement of the S-box and improve the chip's ability to resist side-channel attacks.
2. The anti-power consumption attack method based on a random S-box mask according to claim 1, characterized in that The When recombining the two newly generated S-boxes, before and after accessing data based on the register, the S-box replacement operation is divided into two parts to jointly complete the S-box replacement operation; the first part completes the replacement of part of the data, and the latter part completes the replacement of the remaining data, which are respectively placed before the register storage and after the register retrieval. These two parts are completed by the new S-boxes composed of the s0 box and the s1 box, where the s0 box and the s1 box are formed by randomly decomposing and recombining the original S-box.
3. The anti-power consumption attack method based on a random S-box mask according to claim 2, wherein, The s0 box is composed of the 16×n part of the disassembled S-box and the 16×(16 - n) filled with address information, while the s1 box is composed of the 16×(16 - n) part of the disassembled S-box and the 16×n part filled with address information.
4. A power consumption attack resistance method based on a random S-box mask according to claim 2, characterized in that, The replacement of the s0 box is to replace the data of each group less than 16×n, while the data greater than 16×n remains unchanged.
5. The anti-power consumption attack method based on a random S-box mask according to claim 2, wherein Before storing in the register, the data that has undergone permutation needs to be marked as 1, and the data that has not undergone permutation is marked as 0. At the same time, the mark data is exclusive ORed with the data after s0 replacement to generate a pseudo intermediate value.
6. A method for resisting power consumption attacks based on a random S-box mask according to claim 2, characterized in that, After retrieving from the register, the stored pseudo intermediate value and the mark data need to be exclusive ORed again to restore the data after the original s0 replacement.
7. A method for resisting power consumption attacks based on a random S-box mask according to claim 2, characterized in that The replacement of the s1 box is to replace the restored data with the s1 box data. The data greater than or equal to 16×n is replaced, and the data less than 16×n remains unchanged, finally completing the overall replacement.