A Side-Channel Multi-Byte Key Recovery Analysis Method Based on Multi-Label Learning

Abstract

The present invention relates to the field of information security technology, and specifically relates to a side-channel multi-byte key recovery analysis method based on multi-label learning. First, the signal-to-noise ratio benchmark averaging principle is proposed to screen time sample points with high correlation between each byte key label to form corresponding energy traces. The above operation is repeated on the original energy trace dataset for each byte key according to the signal-to-noise ratio benchmark averaging principle to construct a multi-label dataset. Furthermore, under the algorithm adaptation method of multi-label learning, a multi-label learning model is constructed based on a convolutional neural network. Then, the multi-label learning model is trained and optimized through a random search technique under the multi-label dataset. Finally, a traditional side-channel attack evaluation strategy based on deep learning is adopted to guess the candidate key and the byte sequence number corresponding to the key. The present invention specifically solves the problem of attacking all byte keys under the same device in the side channel through the algorithm adaptation method of multi-label learning.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a side-channel multi-byte key recovery analysis method based on multi-label learning. Background Art

[0002] Currently, most of the methods for Deep-Learning Side Channel Attack (DL-SCA) based on deep learning establish models for single-byte keys, and then adopt a divide-and-conquer strategy to recover all byte keys by repeatedly training the models. Specifically, for the AES-128 cryptographic algorithm, it is necessary to train the model at least 16 times to recover all byte keys.

[0003] In 2020, Zhang et al. proposed a new SCA method using multi-label classification from bit to byte. When the model attack target is a single byte, each energy trace has eight labels. And the experimental results on multiple datasets show that this multi-label classification method is effective; Maghrebi proposed a deep learning side-channel multi-label attack method to recover two-byte keys without adding new time overhead. In 2021, Masure et al. proposed a more secure implementation of the AES-128 algorithm to construct the ASCAD_V2 dataset, and introduced a multi-task learning method to recover all byte keys. These works have all proved that the related work of the multi-label learning method based on neural network can be successfully applied to side-channel analysis.

[0004] Zhang, Maghrebi, Masure et al. applied multi-label learning to side-channel analysis work, and proved the effectiveness of multi-label learning for side-channel multi-byte key recovery through experiments, which can improve the efficiency of side-channel analysis. However, Zhang et al. only used multi-label classification for single-byte key recovery and did not conduct multi-byte attacks. Maghrebi used a multi-layer perceptron network for multi-label attacks and did not combine it with the solution strategy in multi-label learning, and only recovered 2-byte keys. Masure used a residual network model based on a convolutional neural network, introduced a multi-task learning method to aggregate the model to enhance the generalization ability of the model, but at the same time increased the model complexity and training difficulty, and it was difficult to optimize the model.

[0005] In summary, most of the existing side-channel analysis methods based on deep learning adopt a divide-and-conquer strategy, establishing models and training models for single-byte keys respectively to achieve the recovery of all byte keys, which greatly increases the time overhead of model training. Summary of the Invention

[0006] The object of the present invention is to provide a side-channel multi-byte key recovery analysis method based on multi-label learning, aiming to enable a model to attack all byte keys, reduce the number of times of building and training models for recovering all byte keys, and reduce the number of energy traces required to successfully recover each byte key, so as to improve the deficiencies of existing side-channel attack methods based on deep learning.

[0007] To achieve the above object, the present invention provides a side-channel multi-byte key recovery analysis method based on multi-label learning, including the following steps:

[0008] Step 1: Propose a signal-to-noise ratio benchmark principle method to screen the time sample points constituting the corresponding energy traces, and at the same time divide the corresponding training set and test set for the multi-label data set;

[0009] Step 2: Based on the neural network structure model, design a multi-label model by adapting the algorithm of multi-label learning;

[0010] Step 3: Under the multi-label training set, use the random search method of deep learning technology to train the multi-label model;

[0011] Step 4: Under the test set corresponding to each byte key, evaluate the ability of the multi-label model to recover each byte key.

[0012] Among them, the process of constructing the multi-label data set includes the following steps:

[0013] Determine the multi-label set according to the characteristics of the implementation of the cryptographic algorithm on different devices;

[0014] Propose the signal-to-noise ratio benchmark average principle, and screen the corresponding time sample points for each byte key on the original energy traces, and respectively form the energy traces for each byte key used in the multi-label data set;

[0015] Obtain the energy traces of each byte key label respectively by the proposed signal-to-noise ratio benchmark average principle, and then form the corresponding training set and test set according to the multi-label scheme by the multi-label method of measuring traces.

[0016] Among them, the multi-label set corresponding to the energy trace consists of the label corresponding to the energy trace and the key serial number corresponding to the label, and the energy trace label is calculated by the energy power consumption model identification function through the single-byte plaintext and single-byte key corresponding to the corresponding operation. The energy power consumption function depends on the implementation method of the cryptographic algorithm and the corresponding operation performed. The energy power consumption model is a commonly used model in side-channel analysis, which is used to estimate the power consumption model of the target system. Based on the fact that the target system generates different power consumption when executing different instructions or operations, the attacker can infer the internal state information of the target system by measuring the power consumption of the target system when performing different operations.

[0017] Among them, the method of proposing the signal-to-noise ratio benchmark principle is used to screen the time sample points with high correlation corresponding to each byte key, and the number of time sample points with high correlation corresponding to each byte key is maintained to meet the requirement of the same dimension of the input energy trace for deep learning model training;

[0018] The execution process of the signal-to-noise ratio benchmark average principle includes the following steps:

[0019] Step 1: Calculate the signal-to-noise ratio of the label corresponding to each byte key and all time sample points on its energy trace respectively;

[0020] Step 2: Set the signal-to-noise ratio benchmark value as the standard for whether each time sample point can be selected. The signal-to-noise ratio benchmark value needs to make the number of time sample points selected for each byte key close;

[0021] Step 3: After screening by the signal-to-noise ratio benchmark value in Step 2, use the average number of time sample points selected for the label corresponding to each byte key as the number of time sample points constituting the energy trace;

[0022] Step 4: If the number of time sample points selected for a certain byte key to form the energy trace is lower than the average number, use the time sample point with the largest signal-to-noise ratio corresponding to this byte key to fill it so that the number reaches the average value;

[0023] Step 5: If the number of time sample points selected for the byte key is more than the average value, then for the energy trace formed after screening, sequentially eliminate the time sample points with smaller signal-to-noise ratios from small to large according to the signal-to-noise ratio of the time sample points and the label, and reduce it to the average number.

[0024] Among them, in the algorithm adaptation method for implementing multi-label learning based on a convolutional neural network, and then constructing a multi-label model. The model is built using the Python3 language, and the convolutional neural network model is implemented based on tensorflow-gpu-2.2.0. The loss function is set as the binary cross-entropy loss function, and the activation function of the last output layer is Sigmoid.

[0025] Among them, during the process of training the multi-label model using the training set, it is necessary to merge the training sets corresponding to the labels of each byte key and then shuffle them, and then use the backpropagation algorithm and the optimizer function to update the model parameters. At the same time, use random search to find the optimal combination of hyperparameters, and stop the model training until the loss function reaches the minimum value.

[0026] During the process of testing and evaluating the multi-label model, the energy traces are classified and tested using test sets with fixed plaintext and random each-byte key respectively. The two label values predicted by the multi-label model are used to calculate the candidate key score and the candidate byte key sequence number score according to the maximum likelihood estimation. The one ranked first is the most likely to be guessed correctly, and the one ranked last is the least likely to be guessed correctly.

[0027] The present invention provides a side-channel multi-byte key recovery analysis method based on multi-label learning, which is implemented by a multi-label multi-classification method. First, an identity model is used to label the energy traces, and then the signal-to-noise ratio between the labels corresponding to all byte keys and the original energy traces is calculated. The signal-to-noise ratio benchmark average principle is proposed to screen out time sample points with high correlation to form the energy traces corresponding to the labels of each byte key. Based on the convolutional neural network, an algorithm adaptation method of multi-label learning is used to process the solution of multi-label multi-classification to construct a model. The random search technique is used to optimize the model to find the optimal hyperparameter combination. Finally, a traditional side-channel attack evaluation strategy based on deep learning is adopted to guess the candidate key and the candidate byte key sequence number. The present invention enables a single model to attack all byte keys, reduces the number of times of training models for recovering all byte keys, and reduces the number of energy traces required to successfully recover each byte key. Brief Description of the Drawings

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0029] Figure 1 is a schematic flowchart of a side-channel multi-byte key recovery analysis method based on multi-label learning of the present invention.

[0030] Figure 2 is a convolutional neural network structure model diagram used by the present invention to solve the side-channel multi-byte key recovery problem. Detailed Embodiments

[0031] The following details the embodiments of the present invention. The examples of the embodiments are shown in the drawings, where the same or similar reference numerals represent the same or similar elements or elements with the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary and are intended to explain the present invention, and should not be construed as a limitation of the present invention.

[0032] Please refer to Figure 1, the present invention provides a side-channel multi-byte key recovery analysis method based on multi-label learning, including the following steps:

[0033] S1: Propose a signal-to-noise ratio benchmark principle method to screen the time sample points that make up the corresponding energy trace, and at the same time divide the corresponding training set and test set for the multi-label data set;

[0034] S2: Based on the neural network structure model, design a multi-label model through the algorithm adaptation method of multi-label learning;

[0035] S3: Under the multi-label training set, use the random search method of deep learning technology to train the multi-label model;

[0036] S4: Under the test set corresponding to each byte key, evaluate the ability of the multi-label model to recover each byte key.

[0037] Specifically, the process of constructing the multi-label data set includes the following steps:

[0038] Determine the multi-label set according to the characteristics of the cryptographic algorithm implemented on different devices;

[0039] Propose the signal-to-noise ratio benchmark average principle, and screen the corresponding time sample points for each byte key on the original energy trace, and respectively form the energy traces of each byte key for the multi-label data set;

[0040] Obtain the energy traces of the labels of each byte key respectively by the proposed signal-to-noise ratio benchmark average principle, and then form the corresponding training set and test set according to the multi-label scheme for the multi-trace multi-label method.

[0041] Among them, the multi-label set corresponding to the energy trace consists of the label corresponding to the energy trace and the key serial number corresponding to the label, and the energy trace label is calculated by the energy consumption model identification function through the single-byte plaintext and single-byte key corresponding to the corresponding operation. The energy consumption function depends on the implementation method of the cryptographic algorithm and the corresponding operation performed. The energy consumption model is a commonly used model in side-channel analysis, which is used to estimate the power consumption model of the target system. This model is based on the fact that the target system generates different power consumption when executing different instructions or operations. An attacker can infer the internal state information of the target system by measuring the power consumption of the target system when performing different operations.

[0042] On the one hand, since a raw power trace collected through a complete encryption process contains all the time sample points related to each byte key and sensitive information about other operations during the encryption process. If a single power trace collected during the complete encryption process is put into the model for training, the relative number of irrelevant time sample points input into the model increases, which will increase the model complexity and make it difficult to optimize the model training. It is hard to learn the true relationship between the label and the power trace, resulting in a low attack accuracy of the model. On the other hand, under the diffusion effect of the AES algorithm, each byte key may correspond to multiple leakage regions. If only the time sample points under a single spike corresponding to the byte key are used, other time sample points with greater correlation may be missed. At the same time, the number of time sample points under the spike corresponding to each byte key is different.

[0043] Therefore, when recovering multi-byte keys based on deep learning in a side-channel environment, in order to make the model more easily learn the relationship between each byte key and its corresponding time sample points, the sample points with high correlation between the label corresponding to each byte key and all the time sample points on the raw power trace are respectively selected as the power traces constituting the multi-label data set. The specific implementation method is to calculate the signal-to-noise ratio between all the time sample points on the power trace and the label corresponding to each byte key after collecting the raw power trace from the encryption device, and then respectively select the time sample points corresponding to the correlation of each byte key. Among them, the signal-to-noise ratio reflects the correlation between the label and the time sample point. The larger the signal-to-noise ratio value, the greater the correlation, and vice versa. On the other hand, since each byte key under the same device participates in the encryption operation under the same conditions, the leakage degree of each byte key is close, which is reflected in the signal-to-noise ratio between the time sample point and the label. In other words, the number of time sample points corresponding to the label of each byte key with a signal-to-noise ratio greater than a certain reference signal-to-noise ratio value is generally close to the total number of time sample points corresponding to each byte key. In this way, the average number of time sample points corresponding to the label of each byte key greater than a certain reference value can be used as the dimension of the power trace input into the deep learning model. Furthermore, the signal-to-noise ratio reference principle is proposed to realize the screening of the time sample points of the power traces constituting the multi-label data set.

[0044] Among them, the execution process of the signal-to-noise ratio reference average principle includes the following steps:

[0045] Step 1: Calculate the signal-to-noise ratio between the label corresponding to each byte key and all the time sample points on its power trace respectively;

[0046] Step 2: Set the signal-to-noise ratio reference value as the standard for whether each time sample point can be selected. The signal-to-noise ratio reference value needs to make the number of time sample points selected for each byte key close;

[0047] Step 3: After the SNR baseline value screening in Step 2, use the average number of time sample points for which the corresponding tags of each byte key are selected as the number of time sample points constituting the power trace.

[0048] Step 4: If the number of time sample points for which a certain byte key is selected to constitute the power trace is lower than the average number, use the time sample point with the largest SNR corresponding to this byte key for filling to make its quantity reach the average value.

[0049] Step 5: If the number of time sample points for which a byte key is selected is more than the average number, then for the power trace formed after screening, sequentially eliminate the time sample points with smaller SNR values from smallest to largest according to the SNR values of the time sample points and the tags, reducing to the average number.

[0050] The present invention uses an algorithm adaptation method based on a neural network to solve the multi-label problem in side channels. In model construction, the loss function, activation function of the output layer are different from those used in the model constructed with a single-byte key as the target. Generally, the deep learning-based side-channel single-byte attack belongs to the single-label multi-classification problem, uses Softmax as the activation function of the last output layer, uses the multi-class cross-entropy loss function as the loss function, and the output layer contains C neurons corresponding to C classes.

[0051] In side-channel analysis, the tags that characterize the power trace are related to the key, but the byte keys are independent of each other. Applying multi-label learning to the side-channel environment can ignore the correlation between tags. Therefore, the goal of the algorithm adaptation by the first-order strategy is to decompose the multi-label learning task into several independent binary classification problems using a neural network. When solving the multi-byte key recovery problem in the side channel of this article based on the algorithm change method, the output layer of the model needs to use Sigmoid as the activation function. In a multi-label task, each sample can belong to multiple tags, and the output layer needs to output multiple probability values to represent the likelihood of each tag. The Sigmoid function can map the output value in the range of 0 to 1 and can be regarded as a probability value. Therefore, Sigmoid can be used as the activation function of the output layer. For the deep learning model for the single-byte key recovery task, the Softmax activation function used in its output layer can only output one probability value and cannot be directly used for multi-label tasks. The Softmax function specifically compresses each element of a vector into the range of [0,1], and the sum of all elements is 1, which can be regarded as normalizing the probability of each element.

[0052] Secondly, the binary cross-entropy loss function (BCE) is used as the loss function to optimize the model. In the side-channel environment, the tags corresponding to each byte key and the corresponding byte key sequence numbers are independent of each other, and the tag and the corresponding byte key sequence number are also independent. In the algorithm adaptation of the multi-label task based on the first-order strategy, each tag is regarded as an independent binary classification problem, that is, the binary classification problem of each tag can be regarded as two independent categories: the positive class and the negative class. Therefore, for each tag, the binary cross-entropy loss function can be used to train the model. For a sample, if it belongs to the i-th tag, it is regarded as the positive class, otherwise it is regarded as the negative class. Suppose there are M samples and C tags, the goal of model training is to minimize the average binary cross-entropy loss of all tags. Then the average binary cross-entropy loss of all tags can be expressed as:

[0053]

[0054] where, denote y ij ∈ {0, 1} to indicate whether the i-th sample belongs to the j-th tag, represents the probability that the i-th sample belongs to the j-th tag.

[0055] It can be found from the above formula that this loss function is based on the average of the binary cross-entropy loss functions of each tag. That is to say, if the binary loss function of each tag is effective for model optimization, then the entire loss function is also effective for the model to converge to the correct space.

[0056] Among them, in the algorithm adaptation method of implementing multi-label learning based on the convolutional neural network, and then constructing a multi-label model. The model is built using the Python3 language, and the convolutional neural network model is implemented based on tensorflow-gpu-2.2.0. The loss function is set as the binary cross-entropy loss function, and the activation function of the last output layer is Sigmoid. The network structure is as Figure 2 shown.

[0057] Among them, in the process of using the training set to train the multi-label model, it is necessary to merge the training sets corresponding to each byte key tag and then shuffle them, and then use the backpropagation algorithm and the optimizer function to update the model parameters. At the same time, use random search to find the optimal combination of hyperparameters until the loss function reaches the minimum value and then stop the model training.

[0058] Among them, in the process of testing and evaluating the multi-label model, the energy traces are classified and tested using test sets with fixed plaintext and random byte keys respectively. The two label values predicted by the multi-label model are used to calculate the candidate key score and the candidate byte key sequence number score according to the maximum likelihood estimation. The one ranked first is the most likely to be guessed correctly, and the one ranked last is the least likely to be guessed correctly. Generally, the Guess Entropy (GE) is used to evaluate the security of the side-channel model for the cryptographic algorithm under device implementation. The guess entropy is defined as the average rank of the correct guess target. When GE = 0, it means the guess is correct. Among them, the number of energy traces used to make the guess entropy equal to 0 is used to measure the performance of the multi-label key recovery. Specifically, when evaluating the performance of the multi-label model for recovering each byte key using the test sets under each byte key, the reason for using the maximum likelihood to estimate the probabilities of each candidate guessed key and candidate key byte sequence number is as follows:

[0059] Because in a given multi-label classification problem, assume there are M samples in the training set, each sample has C labels, for the i-th sample, its true label is y i =(y i1 ,y i2 ,...,y iC ), and the prediction result of the model is

[0060] Specifically, for each energy trace i, the probability of predicting it correctly can be defined as:

[0061]

[0062] where θ represents the model parameters, represents the prediction result of the model for the j-th label of the i-th energy trace. Then, the prediction probabilities of all energy traces can be multiplied to obtain the likelihood function of the training set:

[0063]

[0064] For the convenience of calculation, the log-likelihood function is usually used instead of the likelihood function:

[0065]

[0066] Then the goal of the maximum likelihood estimation is to maximize the log-likelihood function, that is:

[0067]

[0068] That is, it is equivalent to minimizing the binary cross-entropy loss function:

[0069]

[0070] Therefore, it is reasonable to use the maximum log-likelihood discriminator to predict the labels of the energy traces.

[0071] The following is a further description in combination with specific implementation steps:

[0072] In step S1, the specific steps for constructing the multi-label dataset are as follows:

[0073] (1.1) Determine the multi-label set

[0074] When a deep learning-based model analyzes a single-byte key, it usually selects the energy traces corresponding to a certain byte key in the relevant time sample point area, and then performs model training and attacks. If the label corresponding to the energy trace is increased, and the increased label is the serial number of the corresponding key byte. Then, the energy traces with two labels are put into the multi-label multi-classification model for training, so that the model can learn the leakage characteristics of each key byte. Therefore, when recovering multi-byte keys in a side-channel environment, the multi-label set corresponding to the energy traces can be composed of the label corresponding to the energy trace and the serial number of the key corresponding to the label. In the AES-128 cryptographic algorithm, as shown in equations (1) and (2):

[0075] K = {k|0 ≤ k < 256} (1)

[0076] N = {n|0 ≤ n < 16} (2)

[0077] Among them, K represents the label set corresponding to the energy traces, and N represents the set of byte serial numbers of the keys corresponding to the labels.

[0078] Therefore, when recovering multi-byte keys based on multi-labels in deep learning, the multi-labels corresponding to any energy trace can be expressed as in equation (3):

[0079] (k i ,n i )(3)

[0080] Among them, k i represents the label key of the i-th energy trace, and n i represents the byte serial number of the key corresponding to the label of the i-th energy trace.

[0081] However, it can be seen from equations (1) and (2) that there is an overlapping area between the intermediate value corresponding to the energy trace and the serial number corresponding to the intermediate value, which causes ambiguity when labeling the energy traces. To avoid this problem, on the basis of the byte serial number of the key corresponding to the intermediate value, add |K| to solve it, so that the mapping range of the byte serial number of the label corresponding key does not coincide with the label value range, and the label and the byte serial number of the key corresponding to the label are distinguished. Among them, |K| represents the size of the label value range. As shown in equation (4), the multi-labels of the energy traces can be expressed as:

[0082] (k i ,n i +|K|)(4)

[0083] Furthermore, the energy trace label is calculated from the single-byte plaintext and single-byte key of the corresponding operation through the energy consumption model identification function. Finally, the multi-label representation of the energy trace is as follows:

[0084] (z(k ij ,p ij ),|K|+n i )(5)

[0085] Among them, z(k,p) represents the energy consumption model function, and k ij 、p ij respectively represent the j-th byte key and the j-th byte plaintext corresponding to the i-th energy trace.

[0086] (1.2) are the real-time sample points of the energy trace that makes up the multi-label. Corresponding time sample points are selected for each different byte key on the original energy trace, so as to form the energy trace of the multi-label dataset.

[0087] This patent proposes to use the signal-to-noise ratio benchmark averaging principle to make the energy trace retain as many time sample points with high correlation as possible, and keep their numbers the same. Because for each byte key on the same device, the number of time sample points that leak sensitive information is similar, and the signal-to-noise ratio between the time sample points and the label is also similar as a whole. Therefore, the signal-to-noise ratio benchmark averaging principle can be described as the following steps:

[0088] (1) Calculate the signal-to-noise ratio of the label corresponding to each byte key and all time sample points on its energy trace respectively;

[0089] (2) Set the signal-to-noise ratio benchmark value as the standard for whether each time sample point can be selected. The signal-to-noise ratio benchmark value needs to make the number of time sample points selected for each byte key close;

[0090] (3) After screening by the signal-to-noise ratio benchmark value in step (2), use the average number of time sample points selected for the label corresponding to each byte key as the number of time sample points that make up the energy trace;

[0091] (4) If the number of time sample points selected for a certain byte key to form the energy trace is lower than the average number. Then use the time sample point with the largest signal-to-noise ratio corresponding to this byte key to fill it, so that its number reaches the average value;

[0092] (5) If the number of time sample points for which the byte key is filtered is more than the average, then for the energy traces formed after filtering, the time sample points with smaller signal-to-noise ratios are sequentially removed in ascending order of the signal-to-noise ratio between the time sample points and the labels until the average number is reached.

[0093] (1.3) On the training set and test set taken on the original device, the energy traces of each byte key label are obtained respectively according to the average principle of the signal-to-noise ratio benchmark. According to the multi-label method of energy traces, the corresponding energy traces are attached with their corresponding labels and key byte serial numbers as their multi-labels, and finally the respective training sets and test sets are formed.

[0094] (1.4) To construct a multi-label data set, it is necessary to merge the training sets corresponding to each byte key label and then shuffle them to facilitate the training of the multi-label model. For the evaluation of multi-byte key attacks in the side-channel environment, in order to test the effect of each byte key in the multi-label model, the test sets corresponding to each byte key do not need to be merged, and the test sets corresponding to each byte key can be directly used to evaluate the model performance.

[0095] Step S2: Design a multi-label model through algorithm adaptation. Using the Python3 language, a convolutional neural network model is implemented based on tensorflow-gpu-2.2.0. The specific steps are as follows:

[0096] (2.1) The model is a convolutional neural network, which consists of an input layer, five convolutional blocks, a flattening layer, a fully connected layer, a fully connected layer, and an output layer in sequence. Among them, the convolutional block is composed of a convolutional layer, an activation layer with the activation function Relu, and an average pooling layer.

[0097] (2.2) In order to apply deep learning technology to the problem of multi-label multi-classification, this patent uses an algorithm adaptation algorithm. When designing the model, it is necessary to set the loss function as the binary cross-entropy loss function, and the activation function of the last output layer is Sigmoid;

[0098] (2.3) The number of nodes in the last output layer of the model is set to C, where C is the sum of |K| and |D|, and |D| is the number of target devices under attack.

[0099] Step S3: Use the training set to train the multi-label model;

[0100] The process of multi-label training includes the following steps:

[0101] (3.1) Synchronously shuffle the energy traces and labels of the obtained multi-label training set.

[0102] (3.2) Set different epochs of the backpropagation algorithm and optimizer function to adjust the network model.

[0103] (3.3) Use the random search method to find the optimal combination of hyperparameters, etc. The steps are as follows:

[0104] (3.3.1) Install the Keras Tuner library: pip install keras-tuner;

[0105] (3.3.2) Import the required libraries: from kerastuner.tuners import RandomSearch;

[0106] (3.3.3) Use hp.Int() to define the search space for setting the number of neurons in the model, and use hp.Choice() to define the search space parameters of hyperparameters such as the learning rate, as shown in the following code:

[0107] def cnn_best2(classes = 272, nodenums = 700): # classes represents the number of classifications, the first |Y| corresponds to the candidate keys, and the last |N| columns correspond to the byte key lengths

[0108] input_shape=(nodenums, 1) # Set the input dimension of the model

[0109] img_input = Input(shape = input_shape) # Convert the tensor data type

[0110] # Block 1 is a convolutional block, units is set to a dynamic number of neurons in the range [32, 512], and the optimal number is automatically searched optimally through training. The activation function used is relu, the step size is 32, and the stride is 2

[0111] x = Conv1D(units = hp.Int('units', min_value = 32, max_value = 512, step = 32), 11, strides = 2, activation ='relu', padding ='same', name = 'block1_conv1')(img_input)

[0112] x = AveragePooling1D(2, strides = 2, name = 'block1_pool')(x) # Pooling sampling to extract features

[0113] # Block 2 is the same as Block 1

[0114] x = Conv1D(units=hp.Int('units', min_value=32, max_value=512, step=32), 11, activation='relu', padding='same', name='block2_conv1')(x)

[0115] x = AveragePooling1D(2, strides=2, name='block2_pool')(x)

[0116] # Block 3 is the same as Block 1

[0117] x = Conv1D(units=hp.Int('units', min_value=32, max_value=512, step=32), 11, activation='relu', padding='same', name='block3_conv1')(x)

[0118] x = AveragePooling1D(2, strides=2, name='block3_pool')(x)

[0119] # Block 4 is the same as Block 1

[0120] x = Conv1D(units=hp.Int('units', min_value=32, max_value=512, step=32), 11, activation='relu', padding='same', name='block4_conv1')(x)

[0121] x = AveragePooling1D(2, strides=2, name='block4_pool')(x)

[0122] # Block 5 is the same as Block 1

[0123] x = Conv1D(units=hp.Int('units', min_value=32, max_value=512, step=32), 11, activation='relu', padding='same', name='block5_conv1')(x)

[0124] x = AveragePooling1D(2, strides=2, name='block5_pool')(x)

[0125] # Classification block

[0126] x = Flatten(name='flatten')(x) # Unroll the data of the convolutional layer

[0127] x = Dense(4096, activation='relu', name='fc1')(x) # Fully connected layer for learning features

[0128] x = Dense(4096, activation='relu', name='fc2')(x) # Fully connected layer for enhancing the model's fitting ability

[0129] x = Dense(classes, activation='sigmoid', name='predictions')(x) #

[0130] inputs = img_input

[0131] model = Model(inputs, x, name='cnn_best2') # Construct the model

[0132] model.compile(optimizer=keras.optimizers.RMSprop(learning_rate=hp.Choice('learning_rate', values=[1e - 2, 1e - 3, 1e - 4])), loss='binary_crossentropy', metrics=['accuracy']) # Set the dynamic learning rate and the binary classification loss function

[0133] return model

[0134] (3.3.4) Define hyperparameter search:

[0135] tuner = RandomSearch(model, objective='val_accuracy', max_trials=5, directory='my_dir', project_name='my_project')

[0136] (3.4) Train and search through tuner.search(x_train, y_train, epochs = 5, validation_data=(x_val, y_val)). Here, x_train is a multi-label dataset, and y_train is the multi-label dataset with labels. Stop the model training when the loss function reaches the minimum value and make θ satisfy the following formula.

[0137]

[0138] Among them, θ represents the model parameter space, and n p represents the number of multi-label training sets. Among them, x i represents the i-th energy trace, and y i represents the multi-label corresponding to the i-th energy trace

[0139] (3.5) Obtain the optimal model and hyperparameters:

[0140] best_model = tuner.get_best_models(num_models = 1)[0] # After training, it will automatically return the best model

[0141] best_hyperparameters = tuner.get_best_hyperparameters(num_trials = 1)[0] # Extract the hyperparameter combination of the optimal model.

[0142] Step S4: Test the multi-label model and evaluate it

[0143] The specific steps of the test are as follows:

[0144] (4.1) The multi-label model predicts two label values. Then, split the output matrix into two two-dimensional probability matrices according to its corresponding columns, that is, the first |K| columns correspond to the first label, and the last |N| columns correspond to the second label. Use equations (7) and (8) to represent the probability matrix of the candidate key and the probability matrix of the key serial number respectively

[0145]

[0146]

[0147] Among them, represents the multi-label corresponding to the i-th energy trace, and p i represents the candidate key probability vector of the i-th energy trace corresponding to the byte key sequence number n and has a length of |K|, and q iDenote the probability vector of the candidate byte key of the \(i\)-th energy trace corresponding to the byte key sequence number \(n\), and its length is \(|N|\).

[0148] (4.2) Then, for the obtained probability vector above, the maximum log-likelihood estimation is used to predict the multi-labels of the energy trace. Furthermore, the scores of the candidate keys and the scores of the corresponding sequence numbers of the candidate keys are calculated respectively through the maximum likelihood estimation, and the calculation formulas are as follows:

[0149]

[0150]

[0151] where \(k_n\) represents the \(n\)-th byte key. Denote the probability that the candidate key of the \(i\)-th energy trace corresponding to the byte key sequence number \(n\) is \(j\). Denote the probability that the \(i\)-th energy trace corresponding to the byte key sequence number \(n\) belongs to the \(d\)-th byte key.

[0152] (4.3) Reverse sort the obtained score vector of the corresponding byte key and the score vector of the byte key sequence number . The one ranked first is the most likely to be guessed correctly, and the one ranked last is the least likely to be guessed correctly.

[0153] Compared with the prior art, the present invention has the following beneficial effects:

[0154] (1) One model attacks all byte keys of the cryptographic algorithm under the same device without increasing the additional training time to recover the key;

[0155] (2) Greatly reduce the time required for repeated model training for each byte key;

[0156] (3) Since the features are effectively extracted to form the energy trace, the number of energy traces used to successfully recover a single byte key is reduced;

[0157] (4) The signal-to-noise ratio benchmark principle is proposed to construct the energy traces in the multi-label dataset, which not only retains the most time sample points highly correlated with the labels but also meets the requirements of deep learning training, making the model simpler.

[0158] The above-disclosed is only a preferred embodiment of the present invention. Of course, it cannot be used to limit the scope of the rights of the present invention. Those of ordinary skill in the art can understand all or part of the processes of implementing the above embodiments, and the equivalent changes made according to the claims of the present invention still fall within the scope covered by the invention.

Claims

1. A side-channel multi-byte key recovery analysis method based on multi-label learning, characterized in that, It includes the following steps: Step 1: Propose a signal-to-noise ratio (SNR) benchmark principle method to screen the time sample points that make up the corresponding energy trace, and at the same time divide the corresponding training set and test set for the multi-label data set; The execution process of Step 1 includes the following steps: Determine the multi-label set according to the characteristics of the cryptographic algorithm implemented on different devices; Propose the SNR benchmark average principle, and screen the corresponding time sample points for each byte key on the original energy trace, and respectively form the energy traces for each byte key used in the multi-label data set; The multi-label set corresponding to the energy trace consists of the label corresponding to the energy trace and the key serial number corresponding to the label, and the energy trace label is calculated by the energy consumption model identification function through the single-byte plaintext and single-byte key of the corresponding operation; Obtain the energy traces of each byte key label respectively by the proposed SNR benchmark average principle, and then form the corresponding training set and test set according to the multi-label scheme for the multi-label method of measuring traces; Screen the time sample points with high correlation corresponding to each byte key by the proposed SNR benchmark principle method, and keep the number of time sample points with high correlation corresponding to each byte key so as to meet the requirement of the same input energy trace dimension for deep learning model training; The execution process of the SNR benchmark average principle includes the following steps: Step 1.1: Calculate the SNR of each byte key corresponding label and all time sample points on its energy trace respectively; Step 1.2: Set the SNR benchmark value as the standard for whether each time sample point can be selected. The SNR benchmark value needs to make the number of time sample points selected for each byte key close; Step 1.3: After screening by the SNR benchmark value in Step 1.2, use the average number of time sample points selected for each byte key corresponding label as the number of time sample points that make up the energy trace; Step 1.4: If the number of time sample points selected for a certain byte key to form the energy trace is lower than the average number, fill it with the time sample point with the largest SNR corresponding to this byte key to make its number reach the average value; Step 1.5: If the number of time sample points selected for a byte key is more than the average value, then for the energy trace formed after screening, sequentially remove the time sample points with smaller SNR values from small to large according to the SNR ratio of the time sample point and the label, and reduce to the average number; Step 2: Based on the neural network structure model, implement an algorithm adaptation method for multi-label learning to design a multi-label model; Step 3: Under the multi-label training set, use the random search method of deep learning technology to train the multi-label model; Step 4: Under the test set corresponding to each byte key, evaluate the recovery ability of the multi-label model for each byte key.

2. The side-channel multi-byte key recovery analysis method based on multi-label learning according to claim 1, characterized in that In the method of designing a multi-label model by adapting an algorithm for multi-label learning based on a neural network structure model, the convolutional neural network model is built using the Python3 language and based on tensorflow-gpu-2.2.

0. At the same time, the loss function needs to be set as the binary cross-entropy loss function, and the activation function of the model output layer is selected as Sigmoid to implement the algorithm adaptation method.

3. The side-channel multi-byte key recovery analysis method based on multi-label learning according to claim 2, characterized in that During the process of training the multi-label model using the training set, it is necessary to merge the training sets corresponding to the byte key labels and then shuffle them, and then use the backpropagation algorithm and the optimizer function to update the model parameters. At the same time, random search is used to find the optimal combination of hyperparameters until the loss function reaches the minimum value and the model training stops.

4. The side-channel multi-byte key recovery analysis method based on multi-label learning according to claim 3, characterized in that During the process of testing and evaluating the multi-label model, the energy traces are classified and tested using the test sets with fixed plaintext and random byte keys respectively. The two label values predicted by the multi-label model are used to calculate the candidate key score and the candidate byte key sequence number score according to the maximum likelihood estimation. The one ranked first is the most likely to be guessed correctly, and the one ranked last is the least likely to be guessed correctly.

Images