A method, system and apparatus for plaintext correlation side-channel analysis and protection

Abstract

The present application relates to network security side channel analysis technical field, specifically related to a kind of plaintext correlation side channel analysis and protection method, system and device, first, send the authentication instruction of running MILENAGE algorithm, and the energy waveform consumed when authentication instruction runs is collected, the waveform when r1-r5 operation is executed in energy waveform is intercepted, and the r1-r5 waveform of interception is preprocessed operation, according to the r1-r5 waveform after preprocessing, the input value of r1-r5 corresponding to authentication instruction is calculated respectively, and the correlation coefficient between the hamming weight of input value and waveform is calculated, according to the correlation coefficient, the real value of r1-r5 is calculated, finally, through the confusion of Rotate cyclic shift, the security of MILENAGE algorithm is improved, the technical scheme of the present application, by analyzing the plaintext correlation side channel of restoring MILENAGE algorithm parameter r1-r5, the protection method of confusion of Rotate cyclic shift is proposed, the security of MILENAGE algorithm is greatly improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security side channel analysis, in particular to a plaintext correlation side channel analysis and protection method, system and device. BACKGROUND

[0002] The MILENAGE algorithm is an internationally recognized SIM card communication network authentication algorithm formulated by the 3GPP organization, and its security is the security cornerstone of the modern SIM card communication system. Please refer to Figure 1 , Figure 1 is a MILENAGE algorithm schematic diagram according to an exemplary embodiment, Figure 1 The left side of the schematic diagram is a mobile phone SIM card, and the right side is an operator base station AuC. Both sides perform normal communication after confirming the identity through mutual authentication. The key security parameters involved in the entire authentication algorithm are K, OPc and parameters r1-r5 with a value range of 0-127 used in functions f1-f5, which are specified by the operator.

[0003] In 2015, a team from Shanghai Jiaotong University proposed that K and OPc in the MILENAGE algorithm can be cracked through DPA (Differential Power Analysis), and as long as parameters such as r1-r5 are cracked, a SIM card exactly the same as the attacked card can be copied, which seriously infringes the interests and security privacy of the public.

[0004] At present, the plaintext correlation side channel analysis method can quickly recover the r1-r5 parameters, which is extremely dangerous. SUMMARY

[0005] Therefore, the purpose of the present application is to provide a plaintext correlation side channel analysis and protection method, system and device to solve the problem of significant damage caused by recovering the r1-r5 parameters through the plaintext correlation side channel analysis method in the prior art.

[0006] According to a first aspect of an embodiment of the present application, a plaintext correlation side channel analysis method is provided, comprising:

[0007] Step 1: sending an authentication instruction running the MILENAGE algorithm, and collecting the energy waveform consumed when the authentication instruction runs; wherein the random numbers input by the authentication instruction are different;

[0008] Step 2: intercepting the waveform when the r1-r5 operation is performed in the energy waveform, and performing a preprocessing operation on the intercepted r1-r5 waveform;

[0009] Step 3: calculating the input values of r1-r5 corresponding to the authentication instruction according to the preprocessed r1-r5 waveform, and calculating the correlation coefficient between the Hamming weight of the input value and the waveform;

[0010] Step 4: calculating the real values of r1-r5 according to the correlation coefficient.

[0011] Preferably, the correlation coefficient between the Hamming weight and the waveform of the input value is calculated, specifically:

[0012] The Pearson correlation coefficient between the Hamming weight of the input value sequence and the energy waveform amplitude sequence is calculated.

[0013] Preferably, the calculating the real values of r1-r5 according to the correlation coefficient includes:

[0014] Suppose r = 8*i+j;

[0015] According to the position of the plaintext correlation performance energy waveform peak, the value of i is obtained;

[0016] According to the height of the plaintext correlation performance energy waveform peak, the value of j is obtained;

[0017] According to the values of i and j, the real values of r1-r5 are calculated;

[0018] Wherein, r represents the number of cyclic shifts (input parameter of Rotate cyclic shift operation of 16 bytes), the value range is 0-127; the value range of i is [0, 15]; the value range of j is [0, 7].

[0019] Preferably, the value of i is obtained according to the position of the plaintext correlation peak, specifically:

[0020] When i = a, the correlation coefficient peak sequence between the 16-byte plaintext input and the corresponding Rotate operation waveform should be shifted by a; wherein, the value range of a is [0, 15];

[0021] According to the height of the plaintext correlation performance energy waveform peak, the value of j is obtained, specifically:

[0022] According to the Hamming weight model, the height of the plaintext correlation performance energy waveform and the number of shifts present correlation, and the value of j is obtained according to the height of the energy waveform peak.

[0023] Preferably, the preprocessing operation at least includes: low-pass filtering, alignment and resampling.

[0024] According to the second aspect of the embodiment of the present application, a plaintext correlation side channel protection system is provided, comprising:

[0025] The Rotate cyclic shift in the MILENAGE algorithm is confused to improve the security of the MILENAGE algorithm.

[0026] Preferably, the Rotate cyclic shift in the MILENAGE algorithm is obfuscated to improve the security of the MILENAGE algorithm, in particular:

[0027] In the Rotate cyclic shift operation for calculating the r1-r5 parameters, a Rotate cyclic shift operation of a random number is performed, so that the collected energy waveform is affected by the random number, and the security of the MILENAGE algorithm is improved.

[0028] According to a third aspect of the embodiments of the present application, a system for plaintext correlation side-channel analysis and protection is provided, comprising:

[0029] The acquisition module is configured to send an authentication instruction for running the MILENAGE algorithm, and acquire an energy waveform consumed when the authentication instruction is running; wherein the random number input by the authentication instruction is different;

[0030] The interception module is configured to intercept a waveform when the r1-r5 operation is performed in the energy waveform, and perform a preprocessing operation on the intercepted r1-r5 waveform;

[0031] The first calculation module is configured to calculate input values of r1-r5 corresponding to the authentication instruction according to the preprocessed r1-r5 waveform, and calculate a correlation coefficient between the Hamming weight of the input values and the waveform;

[0032] The second calculation module is configured to calculate the true values of r1-r5 according to the correlation coefficient;

[0033] The obfuscation module is configured to obfuscate the Rotate cyclic shift in the MILENAGE algorithm to improve the security of the MILENAGE algorithm.

[0034] According to a fourth aspect of the embodiments of the present application, a device for plaintext correlation side-channel analysis and protection is provided, comprising:

[0035] The device comprises at least one processor; and

[0036] The memory is in communication connection with the at least one processor; wherein

[0037] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the above-mentioned method.

[0038] According to a fifth aspect of the embodiments of the present application, a non-transitory computer readable storage medium storing computer instructions is provided, comprising: the computer instructions are used to enable a computer to perform the above-mentioned method.

[0039] The technical scheme provided by the embodiment of the present application can include the following beneficial effects:

[0040] In the present application, first, an authentication instruction running the MILENAGE algorithm is sent, and an energy waveform consumed when the authentication instruction runs is collected, a waveform when r1-r5 operations are performed in the energy waveform is intercepted, and a preprocessing operation is performed on the intercepted r1-r5 waveform, the input values of r1-r5 corresponding to the authentication instruction are calculated respectively according to the preprocessed r1-r5 waveform, the correlation coefficient between the Hamming weight of the input value and the waveform is calculated, the true values of r1-r5 are calculated according to the correlation coefficient, and finally, the Rotate cyclic shift is confused to improve the security of the MILENAGE algorithm, the technical scheme of the present application analyzes the plaintext correlation side channel for restoring the MILENAGE algorithm parameters r1-r5, and proposes a protection method of confusing the Rotate cyclic shift, which greatly improves the security of the MILENAGE algorithm.

[0041] Compared with the traditional side channel analysis method, the technical scheme of the present application has strong noise resistance, high accuracy, and greatly improved work efficiency.

[0042] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0043] The accompanying drawings, which are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application and, together with the specification, serve to explain the principles of the present application.

[0044] Figure 1 is a MILENAGE algorithm schematic diagram according to an exemplary embodiment

[0045] Figure 2 is a flowchart of a plaintext correlation side channel analysis method according to an exemplary embodiment;

[0046] Figure 3 is an energy waveform diagram of a MILENAGE algorithm consumed when a certain SIM card executes an authentication instruction according to an exemplary embodiment;

[0047] Figure 4 is an energy waveform diagram of r2 according to an exemplary embodiment;

[0048] Figure 5 is an energy waveform diagram of r4 according to an exemplary embodiment;

[0049] Figure 6 is a selected interval diagram of a static alignment energy waveform of r2 according to an exemplary embodiment;

[0050] Figure 7 is shown according to an example embodiment Figure 6 is a zoomed-in view of a selected interval of the r2 static aligned energy waveform

[0051] Figure 8 is a plot of the r2 energy waveform correlation with plaintext according to an example embodiment

[0052] Figure 9 is a plot of a selected interval of the r4 static aligned energy waveform according to an example embodiment

[0053] Figure 10 is shown according to an example embodiment Figure 9 is a zoomed-in view of a selected interval of the r4 static aligned energy waveform

[0054] Figure 11 is a plot of the r4 energy waveform correlation with plaintext according to an example embodiment

[0055] Figure 12 is a plot of the r2 last 8 bytes and r4 first 8 bytes plaintext correlation results according to an example embodiment

[0056] Figure 13 is a plot of the r2 first 8 bytes and r4 last 8 bytes plaintext correlation results according to an example embodiment

[0057] Figure 14 is a plot of energy waveform analysis of a confusion protection scheme according to an example embodiment

[0058] Figure 15 is a flowchart of a plaintext correlation side-channel protection method according to an example embodiment

[0059] Figure 16 is a block diagram of a plaintext correlation side-channel analysis and protection system according to an example embodiment DETAILED DESCRIPTION

[0060] The example embodiments will be described in detail in this disclosure with reference to the drawings. Whenever the shapes, relative positions and other aspects of the parts described in the embodiments are not clearly defined, the scope of the present disclosure is not limited unless otherwise specified. The same reference numerals are used to denote the same elements throughout the several drawings in which the embodiments of the present disclosure are illustrated by reference to the drawings.

[0061] Embodiment One

[0062] Figure 2is a flow chart of a plaintext correlation side channel analysis method according to an exemplary embodiment, as shown in Figure 2 The method comprises the following steps:

[0063] Step 1: send an authentication instruction running the MILENAGE algorithm, and collect the energy waveform consumed when the authentication instruction runs; wherein the random number input by the authentication instruction is different;

[0064] Step 2: intercept the waveform when r1-r5 operations are performed in the energy waveform, and perform preprocessing operations on the intercepted r1-r5 waveform;

[0065] Step 3: according to the preprocessed r1-r5 waveform, the input values of r1-r5 corresponding to the authentication instruction are calculated respectively, and the correlation coefficient between the Hamming weight of the input value and the waveform is calculated;

[0066] Step 4: according to the correlation coefficient, the true value of r1-r5 is calculated.

[0067] It should be noted that the technical scheme provided in the embodiment is suitable for the scene of recovering the plaintext correlation side channel analysis of MILENAGE algorithm parameters r1-r5 and how to prevent and improve the security of MILENAGE algorithm.

[0068] In 1999, Kocher et al. proposed the idea of side channel attack (SCA). Side channel attack, also known as side channel analysis, is a method of attacking the implementation of a password (including password chips, password modules, password systems, etc.) and ultimately analyzing the key.

[0069] With the development of integrated circuit technology, the implementation of password algorithm in the form of hardware circuit appears in password devices. In practical applications, these hardware devices will leak, for example: energy, time, power consumption, electromagnetic, heat, light and other types of physical information, called side information. Side channel analysis technology uses this information to directly or indirectly obtain intermediate value information in the operation process of the password algorithm, and then can recover the sensitive information (such as the key) in the algorithm in segments.

[0070] It can be understood that in the technical scheme of the embodiment, first, an authentication instruction running the MILENAGE algorithm is sent, and an energy waveform consumed when the authentication instruction runs is collected, a waveform when r1-r5 operations are performed in the energy waveform is intercepted, a preprocessing operation is performed on the intercepted r1-r5 waveform, input values of r1-r5 corresponding to the authentication instruction are calculated according to the preprocessed r1-r5 waveform, a correlation coefficient between a Hamming weight of the input value and the waveform is calculated, the real values of r1-r5 are calculated according to the correlation coefficient, finally, Rotate cyclic shift is confused to improve the security of the MILENAGE algorithm, the technical scheme of the application analyzes the correlation side channel of the recovered MILENAGE algorithm parameters r1-r5, and proposes a protection method of confusing Rotate cyclic shift, which greatly improves the security of the MILENAGE algorithm.

[0071] Compared with the traditional side channel analysis method, the technical scheme of the application has strong noise resistance, high accuracy, and greatly improves the work efficiency.

[0072] In specific practice, step 1: an authentication instruction running the MILENAGE algorithm is sent, and an energy waveform consumed when the authentication instruction runs is collected; wherein the random number input by the authentication instruction is different, and specifically:

[0073] The card reader sends the authentication instruction running the MILENAGE algorithm to the SIM card to be measured, and collects the energy waveform consumed thereby. It should be noted that the random number input when performing authentication each time is different, and the input of each authentication needs to be recorded for calculating the input value corresponding to the authentication instruction when r1-r5 operations are performed subsequently, and the collected energy waveform is shown in Figure 3 , Figure 3 is an energy waveform diagram consumed by the MILENAGE algorithm when a certain SIM card executes an authentication instruction according to an example embodiment.

[0074] In specific practice, step 2: the waveform when r1-r5 operations are performed in the energy waveform is intercepted, and a preprocessing operation is performed on the intercepted r1-r5 waveform, wherein the preprocessing operation at least includes low-pass filtering, alignment and resampling.

[0075] It should be noted that low-pass filtering is a signal filtering method, and the rule is that low-frequency signals can pass normally, and high-frequency signals exceeding the set threshold cannot pass. Static alignment: when the energy waveform feature position exists left and right deviation, static alignment can be used to reduce the transverse deviation of the energy waveform. When using this function, a part of the waveform can be selected in an energy waveform, so that each waveform is aligned with each other with this waveform segment as a reference. The features of the selected waveform segment can be identified by the naked eye, and similar segments can be found in each wave. In the static alignment process, the correlation between the reference energy waveform segment and all energy waveform segments in the offset range of each energy waveform to be aligned is calculated, and the relative position of the maximum correlation is used as the offset value to translate the waveform. The purpose of the preprocessing in this embodiment is to improve the signal-to-noise ratio of the collected energy waveform, improve the success rate when calculating the correlation coefficient, and improve the noise immunity.

[0076] In the technical solution of this embodiment, the waveform of the SIM card during the execution of r1-r5 operations needs to be intercepted and preprocessed by low-pass filtering, alignment and resampling to obtain the energy waveform of the target position. The target position is one of r1-r5. It should be noted that the energy waveform characteristics are very different when the MILENAGE algorithm performs different operations. By analyzing the standard operation process of the MILENAGE algorithm and matching the energy waveform, the position of r1-r5 can be found.

[0077] Specifically, please refer to Figures 4-5 , Figure 4 is an energy waveform diagram of r2 according to an example embodiment. Figure 5 is an energy waveform diagram of r4 according to an example embodiment.

[0078] In specific practice, the correlation coefficient between the Hamming weight of the input value and the waveform is calculated, specifically:

[0079] The Pearson correlation coefficient between the Hamming weight of the input value sequence and the energy waveform amplitude sequence is calculated.

[0080] It should be noted that the Hamming weight is the Hamming distance of a string relative to a zero string of the same length. From the calculation method, the Hamming weight of a string is the number of non-zero elements in the string. For commonly used binary strings, it is the number of 1s in the string. For example: a byte is 11010001, and its Hamming weight is 4.

[0081] The Pearson Correlation Coefficient is used to measure whether two data sets are on a line, which is used to measure the linear relationship between interval variables. In this embodiment, the Pearson Correlation Coefficient is used to calculate the correlation between the input value sequence and the energy waveform amplitude sequence. The calculation formula of the Pearson Correlation Coefficient is a prior art, so this embodiment will not be described again.

[0082] The technical solution of this embodiment is specifically introduced by taking r2 and r4 as examples. After preprocessing of the energy waveform of r2 and r4, such as low-pass filtering and static alignment, the input values of r2 and r4 corresponding to the authentication instruction are calculated, and the correlation coefficient is calculated. Please refer to Figures 6-8 , Figure 6 is a selected interval graph of the r2 static alignment energy waveform according to an exemplary embodiment, Figure 7 is Figure 6 is an enlarged view of the selected interval of the r2 static alignment energy waveform in Figure 8 is a correlation result graph of the r2 energy waveform and the plaintext. Please refer to Figures 9-11 , Figure 9 is a selected interval graph of the r4 static alignment energy waveform according to an exemplary embodiment, Figure 10 is Figure 9 is an enlarged view of the selected interval of the r4 static alignment energy waveform in Figure 11 is a correlation result graph of the r4 energy waveform and the plaintext. As can be seen from the graph, Figure 8 and Figure 11 are the correlation result graphs of the first eight bytes of r2 and r4, respectively. The peak position of r4 is shifted by 8 positions compared to r2, i.e. i = 8 。

[0083] In specific practice, the calculation of the true values of r1-r5 according to the correlation coefficient includes:

[0084] According to the Pearson Correlation Coefficient, the true values of r1-r5 are calculated;

[0085] Suppose r = 8*i+j;

[0086] According to the position of the peak of the plaintext correlation energy waveform, the value of i is obtained;

[0087] According to the height of the peak of the plaintext correlation energy waveform, the value of j is obtained;

[0088] According to the values of i and j, the true values of r1-r5 are calculated;

[0089] Where r represents the number of bits for the circular shift (the input is the parameter of a 16-byte Rotate circular shift operation), and its value ranges from 0 to 127; the value range of i is [0, 15]; and the value range of j is [0, 7].

[0090] In practice, the method of obtaining the value of i based on the position of the plaintext correlation peak is as follows:

[0091] When i = a, the peak order of the correlation coefficient between the 16-byte plaintext input and the corresponding Rotate operation waveform should be shifted by a accordingly; where the value of a ranges from [0,15].

[0092] The value of j is obtained based on the height of the spike in the plaintext correlation energy waveform, specifically:

[0093] According to the Hamming weight model, the height of the plaintext correlation energy waveform is correlated with the number of bits shifted, and the value of j is obtained based on the height of the energy waveform peak.

[0094] It should be noted that for the Rotate operation with a 16-byte input, the parameter r ranges from 0 to 127, meaning the value of r represents the number of bits in the circular shift. Assuming r = 8 * i + j (r1-r5 are each one byte, and one byte has 8 bits; if the shift parameter is a multiple of 8, it won't change the specific value of the shifted number, only its position. Assuming r = 8 * i + j is the most reasonable, as the value of r can be obtained from the position of the waveform peaks), the value of i ranges from [0, 15], and the value of j ranges from [0, 7]. Once i and j are determined, r can be successfully recovered.

[0095] For i, when its value is 0, the order of the correlation coefficient peaks between the 16-byte plaintext input and the corresponding Rotate operation waveform should remain unchanged; if it is 1, the order should be shifted by 1 accordingly... and so on. The value of i can be recovered based on the position order of the plaintext correlation peaks.

[0096] For j, generally speaking, the correlation coefficient of a plaintext byte will have two obvious large peaks, one high and one low. The high peak is caused by moving the original plaintext byte, and the low peak is caused by moving the shifted plaintext byte. According to the Hamming weight model, the height of the correlation coefficient peak is related to the number of bits shifted. That is, the value of j can be recovered from the height of the energy waveform peak.

[0097] Specifically, please refer to Figure 12 , Figure 12is a r2 back 8 bytes and r4 front 8 bytes plaintext correlation result graph according to an exemplary embodiment, it can be seen that the 16 plaintext bytes peak sequence and high and low have not changed, i.e. i and j are both 0, i.e. r = 8*i+j, i = 0, j = 0, so r = 0; using the general hexadecimal representation is 0x00, i.e. the parameter r2 can restore its true value to 0x00, which is consistent with the recommended value in the MILENAGE algorithm standard, and is restored correctly.

[0098] Specifically, please refer to Figure 13 , Figure 13 is a r2 back 8 bytes and r4 front 8 bytes plaintext correlation result graph according to an exemplary embodiment, it can be seen that the 16 plaintext bytes peak sequence and high and low have not changed, i.e. i and j are both 0, i.e. r = 8*i+j, i = 0, j = 0, so r = 0; using the general hexadecimal representation is 0x00, i.e. the parameter r2 can restore its true value to 0x00, which is consistent with the recommended value in the MILENAGE algorithm standard, and is restored correctly.

[0099] Compared with the traditional side channel analysis method (exhaustive search or ordinary side channel CPA method), the method provided in the embodiment greatly improves the work efficiency, shortens the analysis time, and has good user experience.

[0100] Embodiment two

[0101] A plaintext correlation side channel protection method, applied to the above-mentioned side channel analysis method, comprising: confusing the Rotate circular shift in the MILENAGE algorithm to improve the security of the MILENAGE algorithm.

[0102] In specific practice, the confusion of the Rotate circular shift in the MILENAGE algorithm to improve the security of the MILENAGE algorithm is specifically:

[0103] In the Rotate circular shift operation of calculating the r1-r5 parameters, a Rotate circular shift operation of a random number is run to make the collected energy waveform be affected by the random number, thereby improving the security of the MILENAGE algorithm.

[0104] For the plaintext correlation side channel method, a confused protection scheme is added in the implementation of the MILENAGE algorithm, and a Rotate circular shift operation of a random number is run at the same time in the Rotate circular shift operation of calculating the r1-r5 parameters, so that the collected side information will be affected by the random number, thereby greatly improving the difficulty of recovering the correct r1-r5 parameters through the side channel method. Please refer to Figure 14 , Figure 14is an energy waveform analysis chart of a confusion protection scheme according to an exemplary embodiment, from Figure 14 It can be found that there is no obvious leakage, and the security of the MILENAGE algorithm in the SIM card is greatly improved.

[0105] It can be understood that the technical scheme of the embodiment first sends an authentication instruction running the MILENAGE algorithm, and collects the energy waveform consumed when the authentication instruction runs, intercepts the waveform when the r1-r5 operation is performed in the energy waveform, and performs a preprocessing operation on the intercepted r1-r5 waveform. According to the preprocessed r1-r5 waveform, the input values of r1-r5 corresponding to the authentication instruction are calculated respectively, and the correlation coefficient between the Hamming weight of the input value and the waveform is calculated. According to the correlation coefficient, the true value of r1-r5 is calculated. Finally, the Rotate cyclic shift is confused to improve the security of the MILENAGE algorithm. The technical scheme of the present application analyzes the plaintext correlation side channel for restoring the MILENAGE algorithm parameters r1-r5, and proposes a confusion protection method of Rotate cyclic shift, which greatly improves the security of the MILENAGE algorithm. Compared with the traditional side channel analysis method, the technical scheme of the embodiment has strong noise resistance, high accuracy, and greatly improves the work efficiency.

[0106] Based on the above discussion, the technical scheme of the present application has multiple implementation ways, Figure 15 is a flow chart of a plaintext correlation side channel protection method according to an exemplary embodiment, as shown in Figure 15 The method comprises the following steps:

[0107] Start;

[0108] Step S11, control the SIM card to run the MILENAGE algorithm, and collect the energy waveform consumed thereby;

[0109] Step S12, respectively intercept the waveforms when the r1-r5 operation is performed by the SIM card;

[0110] Step S13, for r1-r5, calculate the input value corresponding to each wave, and calculate the correlation coefficient;

[0111] Step S14, for r1-r5, analyze the true value according to the result of the correlation coefficient;

[0112] Step S15, use the confusion protection scheme to improve the security of the algorithm;

[0113] End.

[0114] Embodiment three

[0115] Please refer to Figure 16 ,Figure 16 is a structural schematic diagram of a plaintext correlation side channel analysis and protection system 100 according to an exemplary embodiment, comprising:

[0116] The acquisition module 101 is configured to send an authentication instruction running the MILENAGE algorithm, and acquire an energy waveform consumed when the authentication instruction runs; wherein random numbers input by the authentication instruction are different.

[0117] The intercepting module 102 is configured to intercept a waveform when the r1-r5 operation is performed in the energy waveform, and perform a preprocessing operation on the intercepted r1-r5 waveform.

[0118] The first calculation module 103 is configured to calculate input values of r1-r5 corresponding to the authentication instruction according to the preprocessed r1-r5 waveform, and calculate a correlation coefficient between a Hamming weight of the input value and the waveform.

[0119] The second calculation module 104 is configured to calculate real values of r1-r5 according to the correlation coefficient.

[0120] The confusion module 105 is configured to confuse a Rotate cyclic shift in the MILENAGE algorithm, so as to improve the security of the MILENAGE algorithm.

[0121] It should be noted that the technical scheme provided in the embodiment is suitable for the scene of recovering the plaintext correlation side channel analysis of the MILENAGE algorithm parameters r1-r5 and how to protect and improve the security of the MILENAGE algorithm.

[0122] It can be understood that the technical scheme provided in the embodiment is that the acquisition module 101 is configured to send an authentication instruction running the MILENAGE algorithm, and acquire an energy waveform consumed when the authentication instruction runs; the intercepting module 102 is configured to intercept a waveform when the r1-r5 operation is performed in the energy waveform, and perform a preprocessing operation on the intercepted r1-r5 waveform; the first calculation module 103 is configured to calculate input values of r1-r5 corresponding to the authentication instruction according to the preprocessed r1-r5 waveform, and calculate a correlation coefficient between a Hamming weight of the input value and the waveform; the second calculation module 104 is configured to calculate real values of r1-r5 according to the correlation coefficient; and the confusion module 105 is configured to confuse a Rotate cyclic shift, so as to improve the security of the MILENAGE algorithm. The technical scheme of the present application is that the plaintext correlation side channel of the MILENAGE algorithm parameters r1-r5 is analyzed, and a protection method of confusing the Rotate cyclic shift is proposed, so that the security of the MILENAGE algorithm is greatly improved.

[0123] Embodiment four

[0124] A plaintext correlation side-channel analysis and protection device, characterized in comprising:

[0125] comprising at least one processor; and

[0126] a memory connected with the at least one processor in communication; wherein,

[0127] the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method described above.

[0128] It should be noted that the implementation manner and beneficial effects of each module in the embodiment can be referred to the introduction of the related steps in Embodiment One, and the embodiment will not be described again.

[0129] Embodiment Five

[0130] A non-transitory computer-readable storage medium storing computer instructions, characterized in that the computer instructions are used to enable a computer to perform the method described above.

[0131] It should be noted that the implementation manner and beneficial effects of each module in the embodiment can be referred to the introduction of the related steps in Embodiment One, and the embodiment will not be described again.

[0132] It can be understood that the same or similar parts in the above-mentioned embodiments can be mutually referred to, and the content not described in detail in some embodiments can be referred to the same or similar content in other embodiments.

[0133] It should be noted that in the description of the present application, the terms "first", "second", etc. are only for the purpose of description, and cannot be understood as indicating or implying relative importance. In addition, in the description of the present application, unless otherwise specified, the meaning of "a plurality of" is at least two.

[0134] Any process or method descriptions in flow charts or otherwise described herein can be understood as representing code modules, segments, or portions of code which include one or more executable instructions for performing specific logic functions (or steps) in the process, and the preferred embodiments of the present application include additional implementations in which the order of execution or the specific logic functions (or steps) can be performed differently, or even concurrently or in reverse order without departing from the scope of the present application, as will be understood by those skilled in the art.

[0135] It should be understood that each part of the present application can be realized by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be realized by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if realized by hardware, and as in another embodiment, it can be realized by any one or a combination of the following technologies known in the art: discrete logic circuit with logic gate circuit for implementing logic function on data signal, application specific integrated circuit with suitable combination logic gate circuit, programmable gate array (PGA), field programmable gate array (FPGA) and the like.

[0136] Those skilled in the art of the present technology can understand that all or part of the steps carried out by the above-mentioned embodiment method can be completed by a program instructing the relevant hardware, and the program can be stored in a computer readable storage medium, and when executed, includes one or a combination of steps of the embodiment method.

[0137] In addition, each functional unit in each embodiment of the present application can be integrated into one processing module, or each unit can exist physically, or two or more units can be integrated into one module. The above-mentioned integrated module can be realized in the form of hardware or in the form of software functional module. The integrated module, if realized in the form of software functional module and sold or used as an independent product, can also be stored in a computer readable storage medium.

[0138] The above-mentioned storage medium can be a read-only memory, a magnetic disk or an optical disk, etc.

[0139] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above-mentioned terms does not necessarily mean the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0140] Although the embodiments of the present application have been shown and described above, it should be understood that the above-mentioned embodiments are exemplary and cannot be understood as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above-mentioned embodiments within the scope of the present application.

Claims

1. A method of plaintext -correlation side-channel analysis, characterized in that, The method comprises the following steps: Step 1: sending an authentication instruction running the MILENAGE algorithm, and collecting an energy waveform consumed when the authentication instruction runs; wherein the random numbers input by the authentication instruction are different; Step 2: intercepting the waveform when the r1-r5 operation is performed in the energy waveform, and performing a preprocessing operation on the intercepted r1-r5 waveform; Step 3: calculating the input values of r1-r5 corresponding to the authentication instruction according to the preprocessed r1-r5 waveform, and calculating the correlation coefficient between the Hamming weight of the input value and the waveform; Step 4: calculating the true values of r1-r5 according to the correlation coefficient, comprising: calculating the true values of r1-r5 according to the Pearson correlation coefficient; assuming that r = 8 * i + j; obtaining the value of i according to the position of the peak of the plaintext correlation energy waveform, specifically: when i = a, the peak order of the correlation coefficient between the 16-byte plaintext input and the corresponding Rotate operation waveform should be shifted by a; wherein the value of a ranges from 0 to 15; obtaining the value of j according to the height of the peak of the plaintext correlation energy waveform, specifically: according to the Hamming weight model, the height of the plaintext correlation energy waveform and the number of shifts present correlation, and the value of j is obtained according to the height of the energy waveform peak; calculating the true values of r1-r5 according to the values of i and j; wherein r represents the number of cyclic shifts, the input is the parameter of the Rotate cyclic shift operation of 16 bytes, and the value ranges from 0 to 127; the value of i ranges from 0 to 15; the value of j ranges from 0 to 7; Step 5: obfuscating the Rotate cyclic shift in the MILENAGE algorithm to improve the security of the MILENAGE algorithm, specifically: when calculating the Rotate cyclic shift operation of r1-r5 parameters, running a Rotate cyclic shift operation of a random number to make the collected energy waveform be affected by the random number, thereby improving the security of the MILENAGE algorithm.

2. The method of claim 1, wherein, The calculation of the correlation coefficient between the Hamming weight of the input value and the waveform comprises: calculating the Pearson correlation coefficient between the Hamming weight of the input value sequence and the energy waveform amplitude sequence.

3. The method of claim 1, wherein, The preprocessing operation at least includes low-pass filtering, alignment and resampling.

4. A system for plaintext -correlation side-channel analysis and protection, the system comprising: The method comprises the following steps: The collecting module is configured to send an authentication instruction running the MILENAGE algorithm, and collect an energy waveform consumed when the authentication instruction runs; wherein the random numbers input by the authentication instruction are different; The intercepting module is configured to intercept the waveform when the r1-r5 operation is performed in the energy waveform, and perform a preprocessing operation on the intercepted r1-r5 waveform; The first calculating module is configured to calculate the input values of r1-r5 corresponding to the authentication instruction according to the preprocessed r1-r5 waveform, and calculate the correlation coefficient between the Hamming weight of the input value and the waveform; The second calculating module is configured to calculate the true values of r1-r5 according to the correlation coefficient, comprising: calculating the true values of r1-r5 according to the Pearson correlation coefficient; assuming that r = 8 * i + j; According to the position of the peak of the correlation energy waveform of the plaintext, the value of i is obtained, specifically: when i=a, the peak sequence of the correlation coefficient between the 16-byte plaintext input and the corresponding Rotate operation waveform should be shifted by a; wherein the value range of a is [0, 15]; According to the height of the peak of the correlation energy waveform of the plaintext, the value of j is obtained, specifically: according to the Hamming weight model, the height of the correlation energy waveform of the plaintext and the number of shifts present correlation, and the value of j is obtained according to the height of the peak of the energy waveform; According to the values of i and j, the true values of r1-r5 are calculated; Wherein, r represents the number of cyclic shifts (the parameter of the Rotate cyclic shift operation of the input of 16 bytes), the value range is 0-127; the value range of i is [0, 15]; the value range of j is [0, 7]; The confusion module is used to confuse the Rotate cyclic shift in the MILENAGE algorithm to improve the security of the MILENAGE algorithm, specifically: when calculating the Rotate cyclic shift operation of r1-r5 parameters, a Rotate cyclic shift operation of a random number is run to make the collected energy waveform be affected by the random number, and the security of the MILENAGE algorithm is improved.

5. A plaintext correlation side-channel analysis and protection apparatus, characterized by Comprise: Comprise: at least one processor; and The memory is in communication connection with the at least one processor; wherein The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method of any one of claims 1-3.

6. A non-transitory computer-readable storage medium having stored thereon computer instructions, wherein, The computer instructions are used to make the computer execute the method of any one of claims 1-3.

Images