Anomaly detection apparatus and method based on power analysis of a cryptographic chip

Abstract

The application discloses an abnormality detection device and method based on power consumption analysis of a password chip, and belongs to the technical field of information security. The device comprises a video encryption module, which is used for acquiring a video stream and performing an encryption operation thereon; a power consumption acquisition module, which is used for acquiring power consumption change information of the password chip when the password chip performs the encryption operation; and a data analysis module, which is used for analyzing the power consumption change information, performing abnormality monitoring and responding. By acquiring the voltage waveform between the sampling resistors within the same time length when the password chip performs the encryption operation, the encryption power consumption of different password chips can be effectively acquired, the abnormality monitoring of the remote monitoring picture is realized by analyzing the encryption power consumption, the device does not need to analyze the monitoring picture content frame by frame, the abnormality monitoring efficiency is greatly improved while ensuring the safe transmission of the monitoring picture.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a cryptographic chip power consumption analysis device and anomaly detection method. Background Technology

[0002] With the continuous development of modern network and information technology, remote video surveillance technology has been widely applied in many scenarios where human contact is inappropriate or where human intrusion and damage must be avoided, such as high-voltage areas, data centers, and display cases for valuable items. Therefore, intrusion detection has become a crucial module in security systems. Furthermore, due to the sensitivity and confidentiality of video surveillance content, new security products often employ cryptographic chips to encrypt the monitored content to prevent data tampering and theft. File encryption is a technology that automatically encrypts data written to storage media at the operating system level according to requirements, and the encryption duration is usually positively correlated with the size of the encrypted object. Currently, commonly used methods for intrusion detection include infrared, video, and microwave methods. However, infrared and microwave methods are easily affected by the surrounding electromagnetic environment, resulting in high false alarm rates; while video analysis methods can automatically identify human intrusion, they require significant manpower and computing power, and the results are not always satisfactory. With the massive deployment of surveillance cameras, traditional manual monitoring or intrusion detection schemes based on active energy emission become increasingly complex and cumbersome to implement. To simplify intrusion detection schemes, this invention identifies a complete relationship chain between changes in screen display, data length, and encryption duration, and proposes a novel intrusion detection scheme based on a threshold regression algorithm. In practical applications, the threshold regression algorithm can effectively detect the push-to-the-board time point of the detection statistics. When intrusion behavior is present, the overall detection statistics will rapidly exceed the threshold value, thus enabling timely identification of network intrusion.

[0003] In summary, to address the problems of time-consuming, labor-intensive, inefficient, and high false alarm / missing rate in current monitoring screen anomaly detection, this invention proposes a data acquisition device and anomaly detection method based on cryptographic chip power consumption analysis. This method does not require the addition of other active energy emission devices to the equipment, nor does it require manual supervision, which can greatly reduce detection costs and improve detection accuracy. Summary of the Invention

[0004] The purpose of this invention is to provide an anomaly detection method based on power consumption analysis of cryptographic chips, and to design a corresponding physical experimental device for power consumption analysis, aiming to overcome the shortcomings of existing intrusion detection technologies, such as cumbersome implementation, time-consuming and energy-intensive operation, low efficiency, and high false alarm and missed detection rates.

[0005] To solve the above problems, the present invention adopts the following technical solution:

[0006] In a first aspect, the present invention proposes an anomaly detection device based on cryptographic chip power consumption analysis, comprising:

[0007] A video encryption module is used to acquire video streams and encrypt them. The video encryption module consists of a camera, a cryptographic chip, and a regulated power supply. The camera is used to capture monitoring images of uninhabited areas and transmit the video stream to the cryptographic chip for data encryption. The regulated power supply is used for power supply.

[0008] A power consumption acquisition module is used to collect power consumption change information of the cryptographic chip when performing encryption operations. The power consumption acquisition module consists of a sampling resistor and an oscilloscope. The two ends of the sampling resistor are connected to the ground wire of the cryptographic chip in the video encryption module and the regulated power supply, respectively. The probe of the oscilloscope is connected to the two ends of the sampling resistor.

[0009] The data analysis module is used to analyze the power consumption change information and perform anomaly monitoring and response.

[0010] Furthermore, the encryption operation includes converting the video file into binary plaintext data and performing encryption operations on the plaintext.

[0011] Furthermore, the power consumption change information of the cryptographic chip during the encryption operation is the voltage waveform across the sampling resistor over a period of equal time.

[0012] Furthermore, the data analysis module is connected to the oscilloscope via a serial port connector to set oscilloscope parameters and acquire the voltage waveform across the sampling resistor read by the oscilloscope.

[0013] Furthermore, the sampling resistor is 10Ω, the oscilloscope has a sampling rate of 10GSa / s, and it has communication capabilities.

[0014] Secondly, this invention proposes a detection method for the above-mentioned anomaly detection device based on cryptographic chip power consumption analysis, comprising the following steps:

[0015] Step 1, power consumption data acquisition: The camera transmits the monitoring image data of the same time window to the cryptographic chip for encryption, and the power consumption data stream is collected by the oscilloscope;

[0016] Step 2, power consumption sample acquisition: Segment the power consumption data stream based on encrypted power consumption features;

[0017] Step 3, Data preprocessing: Downsample the segmented power consumption samples to obtain the final downsampled power consumption samples;

[0018] Step 4: Construct an intrusion detection model based on the threshold regression algorithm, calculate the clustering feature values ​​of power consumption samples, and train the intrusion detection model using abnormal sample data and normal sample data.

[0019] Step 5: Intrusion detection is performed in real time by the trained intrusion detection model.

[0020] Furthermore, the duration window for the monitoring screen data mentioned in step 1 is 2 seconds.

[0021] Furthermore, the encrypted power consumption feature is the power consumption peak value, and the power consumption data between two power consumption peak values ​​is taken as a segmented power consumption sample.

[0022] Furthermore, the clustering feature value of the power consumption sample is the sum of all power consumption values ​​within each power consumption sample.

[0023] Furthermore, the intrusion detection model based on the threshold regression algorithm is specifically as follows:

[0024] The difference between the clustering feature values ​​of two adjacent power consumption samples is compared with a preset threshold. If the difference is greater than or equal to the threshold, there is an intrusion risk in the unmanned area, and a warning is issued; otherwise, the detection continues.

[0025] The preset threshold is obtained by training the intrusion detection model based on abnormal sample data and normal sample data.

[0026] This invention proposes an anomaly detection device and method based on cryptographic chip power consumption analysis. It is easy to operate and low in cost. The proposed anomaly detection method is automatically completed by a computer, overcoming the problems of low efficiency and susceptibility to environmental interference in traditional intrusion detection methods.

[0027] Compared with the prior art, the beneficial effects of the present invention include:

[0028] (1) This invention constructs an anomaly detection device based on cryptographic chip power consumption analysis. The device has a simple structure, is easy to operate, and has low cost. It is suitable for power consumption acquisition and analysis of various encryption devices, and can conveniently analyze and verify the power consumption characteristics of encryption algorithms, thereby improving the design efficiency of encryption devices. In addition, the wired access method can greatly reduce the interference of external noise on the power consumption data collection process, and greatly improve the accuracy of power consumption analysis.

[0029] (2) This invention proposes an intrusion detection strategy based on power consumption characteristic changes and a threshold regression method. It cleverly utilizes the power consumption side channel during data encryption to extract power consumption characteristics and achieve anomaly detection in the monitoring screen. Compared to previous intrusion detection methods, such as those using infrared, video, and microwave, this invention is simpler, passively collects signals, requires no active energy emission equipment, and is less costly. The introduction of a threshold regression algorithm transforms the anomaly detection task into a classification problem, automatically achieving detection, further improving detection accuracy and speed, and reducing unnecessary manpower and computing power. Attached Figure Description

[0030] Figure 1 This is a block diagram of the present invention;

[0031] Figure 2 This is a structural block diagram of the anomaly detection device based on cryptographic chip power consumption analysis according to the present invention;

[0032] Figure 3 This is a flowchart of the anomaly detection method based on cryptographic chip power consumption analysis according to the present invention;

[0033] Figure 4 This is a line graph showing the power consumption of video stream data encryption;

[0034] Figure 5 This is a line graph of the segmented power consumption samples;

[0035] Figure 6 It is a plot of the power consumption characteristic difference versus the comparison threshold. Detailed Implementation

[0036] The present invention will be further described below with reference to the accompanying drawings and embodiments. The accompanying drawings are merely illustrative diagrams of the present invention. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software, or in one or more hardware modules or integrated circuits, or in different network and / or processor systems and / or microcontroller systems.

[0037] This invention proposes an anomaly detection device and method based on cryptographic chip power consumption analysis to detect anomalies in monitored scenes. The monitored scene is typically an uninhabited area, and the monitored scene is normally static. The specific implementation process is as follows:

[0038] The anomaly detection device based on cryptographic chip power consumption analysis designed in this invention is applicable to different cryptographic chips, such as... Figure 1 As shown, the device consists of three parts: a video encryption module, a power consumption acquisition module, and a data analysis module. Specifically, it includes a cryptographic chip, sampling resistors, a regulated power supply, an oscilloscope, a camera, and a PC. The device connections are as follows: Figure 2As shown, the video encryption module includes a camera, a regulated power supply, and a cryptographic chip. The camera, powered by the regulated power supply, captures the monitoring footage and transmits the video stream to the cryptographic chip for data encryption. The cryptographic chip is connected to the camera interface, receives the video stream, and performs encryption operations, including converting the video file into binary plaintext data and encrypting the plaintext. The power consumption acquisition module consists of a sampling resistor and a digital oscilloscope. The two ends of the sampling resistor are connected to the ground wires of the cryptographic chip and the regulated power supply, respectively. The oscilloscope probe is connected to the two ends of the sampling resistor to acquire the power consumption changes of the cryptographic chip during encryption operations, i.e., to acquire the voltage waveform across the sampling resistor over a period of time. The data analysis module uses a PC with data collection and processing capabilities. This module is connected to the digital oscilloscope via a serial connector to set oscilloscope parameters and acquire the voltage data across the sampling resistor read by the oscilloscope. This voltage data corresponds to the power consumption changes generated by the cryptographic chip during the encryption process. Based on these power consumption changes, anomaly analysis and processing are performed, and warnings are promptly issued to supervisors when anomalies are detected.

[0039] This invention discloses an anomaly detection method based on cryptographic chip power consumption analysis, the implementation process of which is as follows: Figure 3 As shown, it includes the following steps:

[0040] Step 1, Power Consumption Data Acquisition. In this embodiment, a smartphone camera is used to simulate a surveillance camera. The encryption chip uses SM2 encryption, and the oscilloscope is a Rigol MSO8104 with a sampling rate of 10GSa / s and a sampling resistor of 10Ω. Room video is recorded via the smartphone to simulate the monitoring screen of a data center. A self-developed video segmentation program is used to segment the video into equal-length (2s) segments, encodes them using H.264, and then transmits them to the encryption chip for encryption. The digital oscilloscope acquires power consumption data during the encryption process and transmits the data to the PC via serial port; the PC acquires the power consumption data and stores it locally. In this embodiment, the original power consumption data is as follows: Figure 4 As shown.

[0041] Step 2, Power Consumption Sample Acquisition. In practical applications, since the monitoring data stream is continuously generated, the power consumption data during the encryption process is also continuous. To obtain power consumption samples, the continuous power consumption data needs to be segmented. In this embodiment, based on the characteristics of the encryption chip itself, a power consumption peak is generated before each data read and after each encryption operation, such as... Figure 4 As shown. Therefore, by identifying peak power consumption, continuous power consumption data can be segmented to obtain a power consumption sample array D = (D1, D2, D3...D...). i (i = 1, 2, 3... N), where D iThis represents the i-th power consumption sample after segmentation, which corresponds to the i-th 2s video. N represents the number of power consumption samples, i.e., the number of 2s videos. In this embodiment, the segmented power consumption samples are as follows: Figure 5 As shown.

[0042] Step 3, Data Preprocessing. Since the oscilloscope has a very high acquisition rate (10GSa / s), to reduce computational burden, the power consumption values ​​within each power consumption sample are downsampled before power consumption analysis. In this implementation case, the downsampling factor is 200, meaning that the original power consumption sample is sparsely sampled every 200 data points to obtain the final downsampled power consumption sample array S = (S1, S2, S3...S...). i (i = 1, 2, 3... N).

[0043] Step 4: Constructing the intrusion detection model based on the threshold regression algorithm. Calculate the power consumption sample S after a single downsampling. i =(s i1 ,s i2 ,s i3 ...s ij The clustering feature values ​​of (j = 1, 2, 3...n) are used, with each power consumption sample being a one-dimensional array representing the power consumption data generated by encrypting a 2-second video stream. ij Let represent the j-th power value in the i-th downsampled power consumption sample, and n represent the power consumption length; therefore, the clustering feature value σ of the i-th downsampled power consumption sample is... i It can be represented as:

[0044] σ i =s i1 +s i2 +s i3 +...+s ij (j = 1, 2, 3... n)

[0045] To avoid storing large amounts of data, this embodiment proposes an adjacent feature difference method. This method calculates the difference between the current cluster feature value and the cluster feature value of the previous sample. After calculating the difference, the previous sample data can be released. The cluster feature difference δ i It can be represented as:

[0046] δ i-1 =σ i -σ i-1 (i = 2, 3... N)

[0047] Because when an anomaly occurs, the preceding and following frames in the video change drastically compared to the normal state, a video of the same duration in the abnormal state will contain more data, leading to an increase in encryption time and overall power consumption. Comparing the feature difference with a judgment threshold α allows us to determine whether an anomaly has occurred at the current moment.

[0048]

[0049] Step 5, Intrusion Detection Model Validation. This implementation case involves recording video of a room and having an experimenter move around to simulate external intrusion, while the camera position remains unchanged. The video is transmitted to a cryptographic chip, where data processing yields clustering feature values. The calculated feature difference curve is shown below. Figure 6 As shown in the figure, the external intrusion was successfully detected in 6-10 seconds, further verifying the reliability of the model.

[0050] For the system embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The system embodiments described above are merely illustrative, and the vulnerability detection modules therein may or may not be physically separate. Furthermore, the functional modules in this invention can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The integrated modules or units described above can be implemented in hardware or as software functional units, to select some or all of the modules according to actual needs to achieve the purpose of this application.

[0051] The above examples are merely specific embodiments of the present invention. Obviously, the present invention is not limited to the above embodiments and many variations are possible. All variations that can be directly derived or conceived by those skilled in the art from the disclosure of the present invention should be considered within the scope of protection of the present invention.

Claims

1. An anomaly detection device based on cryptographic chip power consumption analysis, characterized in that, include: The video encryption module is used to acquire video streams and encrypt them. The video encryption module consists of a camera, a cryptographic chip, and a regulated power supply. The camera is used to capture monitoring images of uninhabited areas, and the video stream is divided into segments of equal duration and H264 encoded before being transmitted to the cryptographic chip for data encryption. The regulated power supply is used for power supply. A power consumption acquisition module is used to collect power consumption change information of the cryptographic chip when performing encryption operations. The power consumption acquisition module consists of a sampling resistor and an oscilloscope. The two ends of the sampling resistor are connected to the cryptographic chip in the video encryption module and the ground line of the regulated power supply, respectively. The probe of the oscilloscope is connected to the two ends of the sampling resistor. The power consumption change information of the cryptographic chip when performing encryption operations is the voltage waveform across the sampling resistor over a period of time. The data analysis module is used to analyze the power consumption change information. When analyzing the power consumption change information, it constructs an intrusion detection model based on a threshold regression algorithm, calculates the clustering feature values ​​of the power consumption samples, and trains the intrusion detection model using abnormal and normal sample data. Specifically, the intrusion detection model based on the threshold regression algorithm is as follows: The difference between the clustering feature values ​​of two adjacent power consumption samples is compared with a preset threshold. If the difference is greater than or equal to the threshold, there is an intrusion risk in the unmanned area, and a warning is issued; otherwise, the detection continues. The preset threshold is obtained by training the intrusion detection model based on abnormal sample data and normal sample data; Then, the trained intrusion detection model performs intrusion detection in real time, and monitors and responds to anomalies.

2. The anomaly detection device based on cryptographic chip power consumption analysis according to claim 1, characterized in that, The encryption operation includes converting the video file into binary plaintext data and performing encryption operations on the plaintext.

3. The anomaly detection device based on cryptographic chip power consumption analysis according to claim 1, characterized in that, The data analysis module is connected to the oscilloscope via a serial port connector. It is used to set the oscilloscope parameters and acquire the voltage waveform across the sampling resistor read by the oscilloscope.

4. The anomaly detection device based on cryptographic chip power consumption analysis according to claim 1, characterized in that, The sampling resistor is 10Ω, the oscilloscope has a sampling rate of 10GSa / s, and it has communication capabilities.

5. A detection method for an anomaly detection device based on cryptographic chip power consumption analysis as described in claim 1, characterized in that, Includes the following steps: Step 1, power consumption data acquisition: The camera transmits the monitoring image data of the same time window to the cryptographic chip for encryption, and the power consumption data stream is collected by the oscilloscope; Step 2, power consumption sample acquisition: Segment the power consumption data stream based on encrypted power consumption features; Step 3, Data preprocessing: Downsample the segmented power consumption samples to obtain the final downsampled power consumption samples; Step 4: Construct an intrusion detection model based on the threshold regression algorithm, calculate the clustering feature values ​​of power consumption samples, and train the intrusion detection model using abnormal and normal sample data; the intrusion detection model based on the threshold regression algorithm is specifically as follows: The difference between the clustering feature values ​​of two adjacent power consumption samples is compared with a preset threshold. If the difference is greater than or equal to the threshold, there is an intrusion risk in the unmanned area, and a warning is issued; otherwise, the detection continues. The preset threshold is obtained by training the intrusion detection model based on abnormal sample data and normal sample data; Step 5: Intrusion detection is performed in real time by the trained intrusion detection model.

6. The detection method of the anomaly detection device based on cryptographic chip power consumption analysis according to claim 5, characterized in that, The duration window for the monitoring screen data mentioned in step 1 is 2 seconds.

7. The detection method of the anomaly detection device based on cryptographic chip power consumption analysis according to claim 5, characterized in that, The encrypted power consumption feature is the power consumption peak value, and the power consumption data between two power consumption peak values ​​is taken as a segmented power consumption sample.

8. The detection method of the anomaly detection device based on cryptographic chip power consumption analysis according to claim 5, characterized in that, The clustering feature value of the power consumption sample is the sum of all power consumption values ​​within each power consumption sample.

Images