A hard authentication method and device based on electromagnetic radiation to prevent replay attacks

Abstract

The application discloses a kind of hard authentication method and device based on anti-replay attack of electromagnetic radiation.First, the working mechanism of internal module in the process of data writing is analyzed, and a strict theoretical model is established on this basis, and electromagnetic signal is linked with built-in electronic components of hard disk.Then, the application uses statistical algorithm to quantify the hardware characteristics from the amplitude envelope of electromagnetic signal leaked from hard disk, so that the statistical characteristics obtained can be used as the feature vector of fingerprint signal.In addition, in order to remove the noise interference in electromagnetic signal, the application proposes an effective electromagnetic interference elimination method.In order to further enhance the signal-to-noise ratio of fingerprint signal, the application proposes a folding algorithm for clock jitter suppression, which enhances the intensity of individual sub-clock signal by accumulating sub-clock signals on frequency spectrum, thereby improving the signal-to-noise ratio of fingerprint signal.

Description

Technical Field

[0001] This invention relates to a hard drive authentication method based on electromagnetic radiation, specifically, a hard drive authentication method and apparatus for preventing replay attacks based on electromagnetic radiation. Background Technology

[0002] External hard drives (HDDs) are now widely used for data storage due to their large capacity, fast data transfer speeds, and plug-and-play functionality. However, the interaction between the hard drive and the host computer typically does not require authorization, which poses serious security risks to the host. On one hand, hackers can directly use the hard drive to read (steal) data from the host computer (such as a personal computer), leading to privacy breaches. Such data breaches not only cause significant losses to a company's assets and reputation but also bring privacy breaches and harassment / fraud to the public. On the other hand, if a user inadvertently inserts an infected hard drive into their computer, hackers can inject viruses (such as worms) or malware into the host computer. Worse still, this malicious code may spread across the network, damaging more valuable systems.

[0003] To protect the host from the aforementioned threats, the key lies in the host's control over hard drive access permissions. In other words, before any actual data interaction, the host needs to verify the identity and access level of the external hard drive. In practice, a set of device authentication methods already exists, including device identifiers (such as serial numbers and vendor IDs), digital certificates, and passwords. However, these methods are vulnerable to modification or imitation attacks, making it difficult to support secure interaction between the host and the hard drive.

[0004] To address the aforementioned limitations, hardware fingerprint recognition devices could be considered for hard drive authentication, as hardware fingerprints are an inherent physical characteristic of the device and are difficult to manipulate. However, existing hardware fingerprint recognition methods cannot be directly used for hard drive authentication. These methods can be divided into two categories: one relies on specific hardware modules not present on the hard drive (such as microphones or cameras), which requires additional hardware or modification of the hard drive, making it unsuitable for use with existing hard drives; the other utilizes fingerprints extracted from reflected or leaked wireless signals from the device. However, these methods are vulnerable to replay attacks.

[0005] Therefore, this invention proposes a novel non-contact hard drive authentication system that is resistant to replay attacks. It utilizes electromagnetic signals inadvertently leaked by the hard drive during data writing to acquire and authenticate the hard drive's identity.

[0006] The present invention has the following technical problems:

[0007] 1) Difficulty in extracting representative hardware features from electromagnetic signals: Generally, hardware fingerprints based on electromagnetic signals originate from manufacturing defects in the electronic components inside the device. Hard drives contain many electronic components, making it difficult to directly correlate electromagnetic radiation with these components to prove that the leaked electromagnetic signals indeed contain sufficient hardware features for hard drive authentication.

[0008] 2) Electromagnetic noise in the environment can interfere with signal acquisition: The raw electromagnetic measurement data contains a lot of electromagnetic noise unrelated to hard drive fingerprints, resulting in a low signal-to-noise ratio (SNR) of the target signal. It is difficult to extract high-quality and representative hardware features from noisy electromagnetic signals with low SNR.

[0009] 3) Difficulty in Randomizing Emitted Electromagnetic Signals from Hard Drives: In wireless systems, mitigating replay attacks is typically achieved by randomizing signal parameters (such as amplitude). This signal-level randomization usually requires complete control over the device generating the signal. However, in our hard drive authentication scenario, we cannot directly modify the signal-level electromagnetic signals unintentionally radiated by the hard drive. Therefore, randomizing the emitted electromagnetic signals from the hard drive to mitigate replay attacks is a challenging task. Summary of the Invention

[0010] In view of the aforementioned shortcomings of existing hardware fingerprint recognition technology, those skilled in the art have dedicated themselves to developing a hard drive authentication method and apparatus based on electromagnetic radiation to prevent replay attacks. This apparatus uses the electromagnetic signals unintentionally leaked by the hard drive when the host writes data to it as the hard drive's hardware fingerprint for authentication. This is because the leaked electromagnetic signals reflect the inherent hardware characteristics of the hard drive, thus serving as a fingerprint. Furthermore, this invention resists replay attacks by introducing randomness into the leaked electromagnetic signals. This invention is achieved through the following technical solutions:

[0011] This invention discloses a hard disk authentication method for preventing replay attacks based on electromagnetic leakage, the method comprising device registration and device authentication;

[0012] Device registration includes the following steps:

[0013] 1) Obtain the electromagnetic signal containing its fingerprint information leaked from the hard drive for registration, and obtain the registered electromagnetic signal; the electromagnetic signal containing its fingerprint information leaked from the hard drive is obtained from the hard drive through the software-defined radio of the sensor;

[0014] 2) Remove noise interference from the registered electromagnetic signal, improve the signal-to-noise ratio of the electromagnetic signal, obtain the fingerprint signal, and use it for registration;

[0015] 3) Extract the feature vector of the fingerprint signal to form positive samples; extract the feature vectors provided by other hard drives in the database as negative samples; the database stores the feature vectors of other hard drives, and the feature vectors provide negative samples for training the binary classifier of the newly registered hard drive;

[0016] 4) Based on positive and negative samples, generate a binary classifier for each hard drive. The binary classifier and hard drive ID for each hard drive are stored in the device's database.

[0017] Equipment certification includes the following steps:

[0018] 5) Query the ID of the hard drive that is trying to interact with the host, and obtain the electromagnetic signal leaked by the hard drive for authentication; obtain the authentication electromagnetic signal.

[0019] 6) Remove noise interference from the electromagnetic signal used for authentication and improve the signal-to-noise ratio of the electromagnetic signal to obtain the processed electromagnetic signal. The processed electromagnetic signal includes two parts: a preamble signal used for replay detection and a fingerprint signal used for authentication.

[0020] 7) Extract and verify the bit sequence based on the preamble signal to detect whether the received electromagnetic signal comes from the playback device;

[0021] 8) Extract feature vectors from the fingerprint signal used for authentication;

[0022] 9) The feature vector is fed into a binary classifier associated with the hard drive ID to achieve hard drive authentication.

[0023] As a further improvement, the sensor of the present invention is used to capture electromagnetic signals, including a software-defined radio, a low-noise amplifier, and an antenna connected in sequence. The electromagnetic signals containing fingerprint information leaked from the hard drive are wirelessly acquired from the hard drive through the antenna, and then transmitted to the processor in sequence through the low-noise amplifier and the software-defined radio. The electromagnetic signals containing fingerprint information leaked from the hard drive are generated by a data writing program.

[0024] As a further improvement, in step 2) of the present invention, removing noise interference from the registered electromagnetic signal specifically involves multiplying the electromagnetic signal by a convolution kernel [-0.5, 1, -0.5].

[0025] As a further improvement, in step 2) of the present invention, improving the signal-to-noise ratio of the electromagnetic signal specifically involves: first, processing the denoised electromagnetic signal s... data (t) Perform a short-time Fourier transform to obtain the time spectrum X of the electromagnetic signal: X = |STFT[s data (t)]| 2 Then, if the sampling rate is f s Then the frequencies of two adjacent sub-clocks are determined by Separated by discrete Fourier transform frequency points, the sub-clock signal in the electromagnetic signal is distributed in the time spectrum X at the j, (j-θ),…,[j-(k-1)×θ]th discrete Fourier transform frequency points. Then the signal enhancement result P[j,t] at time t can be expressed as:

[0026]

[0027] Next, the fingerprint signal was obtained by tracking the maximum value of P[j,t] in real time within a certain frequency range.

[0028] As a further improvement, the principle of extracting the feature vector of the fingerprint signal in step 3) of the present invention is as follows: First, by analyzing the working mechanism of the internal module of the hard disk during the data writing process, and linking the fingerprint signal with the built-in electronic components of the hard disk, it is known that the amplitude envelope of the fingerprint signal contains the hardware characteristics of the clock module and DRAM module (i.e., dynamic random access memory) in the hard disk.

[0029] As a further improvement, the present invention extracts the feature vector of the fingerprint signal by: quantizing the hardware characteristics from the amplitude envelope of the fingerprint signal through a statistical algorithm, and the obtained statistical features can be used as the feature vector of the fingerprint signal.

[0030] As a further improvement, in step 4) of this invention, the positive sample is the feature vector extracted from the fingerprint signal leaked from the registered hard drive, and the negative sample is the feature vector of the fingerprint signal of other hard drives provided in the database.

[0031] As a further improvement, the preamble signal in step 7) of the present invention is obtained by randomly selecting a one-time bit sequence as a security credential and correspondingly switching the write buffer, thereby introducing randomness into the electromagnetic signal.

[0032] As a further improvement, step 7) of the present invention detects whether the received electromagnetic signal comes from the replay device by comparing the bit sequence extracted from the preamble signal with the security credentials to detect replay attacks.

[0033] This invention also discloses a hard drive authentication device for preventing replay attacks based on electromagnetic radiation, comprising:

[0034] Electromagnetic signal capture module for registration: used to obtain electromagnetic signals containing fingerprint information leaked from the hard drive for registration, and obtain the registered electromagnetic signal; the electromagnetic signals containing fingerprint information leaked from the hard drive are obtained from the hard drive through the software-defined radio of the sensor;

[0035] Registration signal enhancement module: used to remove noise interference in the electromagnetic signal during registration, improve the signal-to-noise ratio of the electromagnetic signal, obtain the fingerprint signal, and use it for registration;

[0036] Registration Feature Extraction Module: Used to extract feature vectors from fingerprint signals to form positive samples; extract feature vectors from other hard drives in the database as negative samples; the database stores feature vectors from other hard drives, which provide negative samples for training a binary classifier for newly registered hard drives;

[0037] Binary classifier generation module: used to generate a binary classifier for each hard drive based on positive and negative samples. The binary classifier and hard drive ID for each hard drive are stored in the device's database.

[0038] Authentication electromagnetic signal capture module: used to query the ID of the hard drive attempting to interact with the host, and obtain the electromagnetic signals leaked by the hard drive for authentication, thus obtaining the authentication electromagnetic signals;

[0039] Authentication signal enhancement module: used to remove noise interference in the authentication electromagnetic signal, improve the signal-to-noise ratio of the electromagnetic signal, and obtain the processed electromagnetic signal. The processed electromagnetic signal includes two parts: a preamble signal for replay detection and a fingerprint signal for authentication.

[0040] Replay detection module: used to extract and verify bit sequences based on preamble signals to detect whether the received electromagnetic signals come from the replay device;

[0041] Authentication Feature Extraction Module: Used to extract feature vectors from the fingerprint signal used for authentication;

[0042] Hard drive authentication module: Used to input feature vectors into a binary classifier associated with the hard drive ID to achieve hard drive authentication.

[0043] The beneficial effects of this invention are as follows:

[0044] This invention proposes a hardware authentication system that utilizes electromagnetic radiation technology to prevent replay attacks. To extract the hardware characteristics of a hard drive from leaked electromagnetic signals, this invention first analyzes the working mechanism of the hard drive's internal modules during data writing and establishes a rigorous theoretical model, linking the electromagnetic signals to the hard drive's built-in electronic components. Next, this invention employs a statistical algorithm to quantify these hardware characteristics from the amplitude envelope of the leaked electromagnetic signals, and the resulting statistical features can be used as feature vectors for fingerprint signals. Furthermore, to remove noise interference from the electromagnetic signals, this invention proposes an effective electromagnetic interference cancellation method. To further enhance the signal-to-noise ratio (SNR) of the fingerprint signal, this invention proposes a clock jitter suppression folding algorithm. This algorithm enhances the strength of individual sub-clock signals by accumulating sub-clock signals across the spectrum, thereby improving the SNR of the fingerprint signal. Experimental results show that when directly extracting feature vectors from the original fingerprint signal, the hard drive's authentication success rate is below 86%, while the average false positive rate is greater than 7%. However, after improving the SNR through the clock jitter suppression folding algorithm, the authentication success rate increases to 92.73%, while the false positive rate decreases to 2.47%. This demonstrates that the clock jitter suppression folding method can effectively improve the signal-to-noise ratio. When both signal processing methods are used simultaneously, the average authentication success rate increases to 99.5%, while the average false positive rate decreases to 1.5%. This shows that the electromagnetic interference cancellation method can also effectively eliminate noise in fingerprint signals. Finally, to randomize the electromagnetic signals emitted by the hard drive to resist replay attacks, this invention does not perform randomization at the signal level, but designs a sophisticated application-level randomization mechanism. We found that manipulating the write cache state of the hard drive (i.e., on / off) leaks electromagnetic signals with different waveforms. By randomly selecting a one-time bit sequence as the security credential and switching the write cache accordingly, we can achieve the same defensive effect as signal-level randomization. That is, once the switch sequence extracted from the real electromagnetic signal is different from the security credential, we can detect the presence of a replay signal. Experiments show that the replay attack success detection rate is 100%. This indicates that the method can effectively resist anti-replay attacks, thereby greatly improving the security of the hard drive authentication system.

[0045] This invention can utilize the electromagnetic signals unintentionally emitted by a hard drive when writing data to achieve hard drive authentication against replay attacks.

[0046] This invention designs a folding algorithm for clock jitter suppression, which can effectively enhance the signal-to-noise ratio of fingerprint signals.

[0047] This invention presents a method for eliminating electromagnetic interference based on convolutional filtering, which can effectively remove electromagnetic interference from fingerprint signals.

[0048] This invention constructs a rigorous theoretical model by studying the working mechanism of the internal modules of a hard disk during the data writing process, and links electromagnetic signals with the built-in electronic components of the hard disk.

[0049] This invention utilizes statistical algorithms to quantify the hardware characteristics of a hard drive from the amplitude envelope of electromagnetic signals leaked from the hard drive, and forms a stable and highly distinguishable feature vector.

[0050] This invention designs a sophisticated application-level randomization mechanism that can effectively resist replay attacks. Attached Figure Description

[0051] Figure 1 A flowchart of a hard drive authentication method for preventing replay attacks based on electromagnetic signals; Detailed Implementation

[0052] This invention discloses a hard disk authentication system for preventing replay attacks based on electromagnetic leakage. The system includes device registration and device authentication. Device registration includes the following steps:

[0053] 1) Obtain the electromagnetic signal containing its fingerprint information leaked from the hard drive for registration, and obtain the registered electromagnetic signal; the electromagnetic signal containing its fingerprint information leaked from the hard drive is acquired from the hard drive through the software-defined radio of the sensor; the sensor used to capture the electromagnetic signal includes a software-defined radio, a low-noise amplifier and an antenna connected in sequence; the electromagnetic signal containing its fingerprint information leaked from the hard drive is wirelessly acquired from the hard drive through the antenna, and then transmitted to the processor in sequence through the low-noise amplifier and the software-defined radio; the electromagnetic signal containing its fingerprint information leaked from the hard drive is generated by the data writing program.

[0054] 2) Remove noise interference from the registered electromagnetic signal, improve the signal-to-noise ratio of the electromagnetic signal, obtain the fingerprint signal, and use it for registration;

[0055] 3) Extract the feature vector of the fingerprint signal to form positive samples; extract the feature vectors provided by other hard drives in the database as negative samples; the database stores the feature vectors of other hard drives, and the feature vectors provide negative samples for training the binary classifier of the newly registered hard drive;

[0056] 4) Based on positive and negative samples, generate a binary classifier for each hard drive. The binary classifier and hard drive ID for each hard drive are stored in the device's database.

[0057] Equipment certification includes the following steps:

[0058] 5) Query the ID of the hard drive that is trying to interact with the host, and obtain the electromagnetic signal leaked by the hard drive for authentication; obtain the authentication electromagnetic signal.

[0059] 6) Remove noise interference from the electromagnetic signal used for authentication and improve the signal-to-noise ratio of the electromagnetic signal to obtain the processed electromagnetic signal. The processed electromagnetic signal includes two parts: a preamble signal used for replay detection and a fingerprint signal used for authentication.

[0060] 7) Extract and verify the bit sequence based on the preamble signal to detect whether the received electromagnetic signal comes from the playback device;

[0061] 8) Extract feature vectors from the fingerprint signal used for authentication;

[0062] 9) The feature vector is fed into a binary classifier associated with the hard drive ID to achieve hard drive authentication.

[0063] This invention aims to utilize the electromagnetic signals leaked by a hard drive during data writing, which contain the hard drive's hardware characteristics, to construct an electromagnetic signal-based hard drive authentication system. This authentication system can also effectively resist replay attacks. Specifically, the system consists of two phases: a registration phase and an authentication phase. In the registration phase, the authentication system first writes data to the hard drive through a data writing program, thereby generating a fingerprint signal. This invention first removes electromagnetic interference from the fingerprint signal using an electromagnetic interference cancellation method based on convolutional filtering. Furthermore, to further improve the signal-to-noise ratio of the fingerprint signal, this invention proposes a folding algorithm based on clock jitter suppression. The authentication system extracts features from the enhanced fingerprint signal in both the time and frequency domains to form a feature vector, which serves as positive samples for training the binary classifier corresponding to that hard drive. The negative samples for the binary classifier come from the feature vectors of other hard drives in the database. Based on the positive and negative samples, a binary classifier for each hard drive can be trained. Each hard drive's binary classifier is bound to its ID and stored in the system's database. In the registration phase, when a hard drive attempts to interact with the host, the authentication system first queries the hard drive's ID. Next, the authentication system uses a data writing program to write data to the hard drive to generate an electromagnetic signal. This electromagnetic signal consists of two parts: a signal segment for playback detection (called a preamble) and a fingerprint signal. The authentication system then determines whether the received electromagnetic signal originates from the playback device by detecting the preamble. If not, the fingerprint signal undergoes the same signal enhancement, preprocessing, and feature extraction as in the registration phase. The extracted feature vector is then input into a pre-trained hard drive identifier associated with its ID to determine whether the hard drive is legitimate.

[0064] The following section provides further explanation and illustrations, along with specific steps and diagrams from the instruction manual. Figure 1 A flowchart of a hard drive authentication method for preventing replay attacks based on electromagnetic signals; specifically including the following steps:

[0065] Step 1) Register the acquisition of electromagnetic signals

[0066] By using a data writing program to write data to the hard drive, fingerprint signals of hard drive leaks can be collected.

[0067] Step 2) Signal Enhancement

[0068] The electromagnetic signal acquisition process is susceptible to interference from other electromagnetic sources in the environment. Furthermore, each hard drive must undergo electromagnetic compatibility testing as required. However, adhering to these requirements results in relatively low strength of the original fingerprint signal. Both of these factors degrade the quality of the extracted fingerprint and reduce authentication accuracy. To address these issues, this invention proposes two signal enhancement techniques: electromagnetic interference cancellation and clock jitter resistance folding technology.

[0069] Step 2.1) Electromagnetic interference elimination

[0070] Fingerprint signals can be masked by electromagnetic interference in the environment, potentially preventing the use of folding algorithms for fingerprint authentication. Therefore, the authentication system employs a convolutional filtering-based method to remove electromagnetic interference. Specifically, the system multiplies the original fingerprint signal by a convolution kernel [-0.5, 1, -0.5] to obtain a new signal. Since the sub-clock signals are correlated, while the noise is independent, electromagnetic interference in the new signal is effectively suppressed. The folded result of this denoised signal is then the folded result of the fingerprint signal.

[0071] Step 2.2) Signal-to-noise ratio enhancement

[0072] The signal-to-noise ratio of the fingerprint signal is enhanced through a folding algorithm that suppresses clock jitter. Specifically, the fingerprint signal s is first processed... data (t) Perform a short-time Fourier transform to obtain the time spectrum X of the fingerprint signal. The STFT applies the Hanning window function w to s data (t), s data (t) is divided into several segments of equal length, and then an N-point Discrete Fourier Transform (DFT) is performed on each segment. The resulting time spectrum X can be expressed as:

[0073] X = |STFT[s data (t)]| 2

[0074] Because fingerprint signals consist of a series of equally spaced f signals in the frequency domain m The fingerprint signal is composed of distributed sub-clock signals, and the amplitudes of different sub-clock signals change consistently over time. Therefore, this invention improves the signal-to-noise ratio of the fingerprint signal by accumulating sub-clock signals across the spectrum. Assume the sampling rate is f. s Then the frequencies of adjacent sub-clocks are determined by are separated by discrete Fourier transform frequency points. The sub-clock signal in the fingerprint signal is distributed in the time-frequency spectrum X at the j-th, (j-θ)-th, …, [j-(k-1)×θ]-th discrete Fourier transform frequency points. Then the folding result P[j,t] at time t can be expressed as:

[0075]

[0076] In addition, since the frequency of the sub-clock jitters within a small range (the upper limit is f m ), the present invention tracks the maximum value of the folding result within a certain interval [h-0.5×θ,h+0.5×θ], and updates h to the value whose folding result is significantly larger than other results. In this case, the present invention can track the frequency of the sub-clock in real time, and ultimately improve the signal-to-noise ratio of the fingerprint signal.

[0077] Step 3) Extraction of feature vectors

[0078] Before extracting the feature vector of the hard disk from the fingerprint signal, the present invention first analyzes the working mechanism of the internal modules of the hard disk during the data writing process, and establishes a strict theoretical model based on this, which associates the electromagnetic signal with the built-in electronic components of the hard disk. Specifically, when data is written to the hard disk, the high activity of its internal electronic components will cause a large current, which further generates an electromagnetic signal. The clock module and the dynamic random access memory (DRAM) module are the main sources of these electromagnetic signals, and the electrical characteristics of the electronic components in these modules mainly determine the change of the signal strength (i.e., the amplitude envelope). Due to manufacturing imperfections, these electronic components contain "unique" features. Therefore, the electromagnetic signal leaked from each hard disk will be unique and can be used for fingerprint identification. Since the number of these electronic components is very large, the extracted fingerprint will be highly distinguishable. Therefore, based on this theoretical model, the present invention extracts the feature vector of the hard disk from the amplitude envelope of the electromagnetic signal. Specifically, during the input / output operation of the hard disk, such as writing data, an electromagnetic signal s data (t) is generated. This signal is mainly composed of two parts: one part comes from the clock module (s clk (t)), and the other part comes from the DRAM module (s dram (t)). Since the write operation of the DRAM module is synchronized with the clock edge, s dram (t) is amplitude-modulated onto s clk (t), and finally leaks the signal s data (t). The signal s clk (t) leaked from the spread spectrum clock in the hard disk is the sum of multiple sub-clock signals distributed at frequencies f0-if m (0≤i<k), which can be expressed as:

[0079]

[0080] Among them, A i The amplitude of the i-th sub-clock is determined by the bandpass filter and frequency modulator. Due to hardware defects in the manufacturing process, these components vary between different clock modules, resulting in variations in the amplitude of different hard drives. clk (t) is distinguishable. Furthermore, within a DRAM module, millions of complementary metal-oxide-semiconductor (CMOS) transistors are arranged in a lattice to form a DRAM memory region for temporary data storage. A cell within a DRAM memory region consists of a CMOS transistor and a capacitor. During data writing, the continuous charging and discharging of the CMOS transistor in the cell generates a large current. According to Maxwell's equations, these changing currents will produce an accompanying electromagnetic signal s. dram The electromagnetic field of (t). That is, s dram (t) is mainly due to the dynamic power consumption P of the CMOS circuit. dynamic It is determined by the directly related changing current. Specifically, P dynamic It can be represented as:

[0081]

[0082] Where C is the equivalent capacitance determined by the CMOS transistor. V DD This represents the supply voltage determined by the voltage regulator and power controller in the DRAM module, f0 represents the clock signal frequency determined by the clock module, and α refers to the activity factor determined by the workload of the DRAM module. During the manufacturing process, hardware defects in related electronic components within the DRAM can lead to V... DD The uniqueness of f0 and C, thus radiating distinguishable s dram (t) signal. Therefore, due to s clm (t) and s dram (t) can represent the unique hardware characteristic of the hard drive, s data The amplitude envelope of (t) has the potential to serve as a fingerprint feature for hard drives. To avoid the impact of different workloads of DRAM modules on s data Due to the influence of t, when authenticating a hard drive, the system repeatedly writes data to a fixed area of ​​the hard drive at maximum speed. Next, the hard drive leakage signal s... data The feature extraction of the amplitude envelope in (t) mainly includes two parts: signal preprocessing and quantization feature vector.

[0083] Step 3.1) Signal preprocessing

[0084] Before extracting feature vectors, the authentication system first preprocesses the folded result P[j,t]. First, the system uses an outlier detection method based on median absolute deviation (MAD) to remove outliers from the folded result P[j,t]. Then, min-max normalization is used to limit the range of P[j,t] to [0,1]. The normalized folded result can be expressed by the formula... Calculated.

[0085] Step 3.2) Quantization of feature vectors

[0086] During the quantization of feature vectors, the authentication system obtains the folded result P' norm Twelve statistical features were selected in both the time and frequency domains of [t], including mean, median, standard value, coefficient of variation, median absolute deviation, mean absolute deviation, root mean square, skewness, kurtosis, shape factor, peak factor, and impulse factor. These 24 features form a feature vector, which is used as the input to the hard disk binary classifier in step 5).

[0087] Step 4) Classifier generation

[0088] The authentication system uses supervised learning to classify hard drives. Specifically, each registered hard drive provides k feature vectors as positive samples, while the system's database provides k feature vectors from other registered hard drives as negative samples. These samples form the training set for the hard drive binary classifier. Each hard drive's binary classifier (which only needs to be trained once) is associated with its ID.

[0089] Step 5) Acquisition of authentication signal

[0090] When an external hard drive attempts to interact with the host, the host first queries the hard drive's ID and writes data to the hard drive to obtain the electromagnetic signals leaked by the hard drive for subsequent authentication.

[0091] Step 6) Detection of replay attacks

[0092] The authentication system employs a binary encoding scheme to detect replay attacks. Specifically, when the hard disk write cache is opened or closed, it generates electromagnetic signals with large or small discreteness, which can be encoded as binary 1s or 0s. Based on this phenomenon, this invention first designs a binary encoding scheme. By alternately opening and closing the write cache over a period of time, the authentication system can obtain a bit sequence such as "10111...". Next, the authentication system uses this bit sequence to detect whether a replay attack has occurred. Before generating the preamble signal, the authentication system randomly selects a one-time bit sequence as a security credential and embeds it into the electromagnetic signal as the preamble. When the authentication system receives the preamble signal, it extracts the bit sequence according to the encoding scheme. By comparing the extracted bit sequence with the security credential, the system can detect replay attacks.

[0093] Step 6.1) Extraction of bit sequence

[0094] When the authentication system receives the preamble signal, it extracts the bit sequence according to the encoding scheme. Specifically, the authentication system first removes discrete points from the preamble signal, which can be considered as sharp noise. Then, the authentication system normalizes the preamble signal. Next, the authentication system uses the coefficient of variation to determine whether each segment in the preamble signal is "0" or "1". In particular, the authentication system identifies each bit through the following steps: (1) sliding a window across the normalized preamble signal and calculating the coefficient of variation for each window, which will generate a preliminary coefficient of variation sequence D; (2) smoothing the sequence D through mean filtering to obtain a smoothed sequence D′; (3) setting an empirical threshold D′. thr This is used to detect the boundary between high and low coefficients of variation in D′. If the element at index i in D′ satisfies D′(i-1), then... <D' thr And D'(i+1)>D' thr If the value is true, then the element is a boundary from "0" to "1"; otherwise, it is a boundary from "1" to "0". In this way, the authentication system can extract bit sequences from sequence '.

[0095] Step 6.2) Verification of the bit sequence

[0096] After extracting the bit sequence from the preamble, the authentication system compares the bit sequence with the security credentials. If the extracted bit sequence differs from the security credentials, it determines that the authentication request was initiated by a replay attacker. It's important to note that this bit sequence is 10 bits by default.

[0097] Step 7) Hard drive authentication

[0098] When a hard drive attempts to interact with a host, it should first display its ID to the authentication system. The authentication system then inputs the feature vector extracted from the hard drive into a binary classifier associated with that ID to verify the authenticity of the identity claimed by the hard drive.

[0099] This invention also discloses a hard drive authentication device for preventing replay attacks based on electromagnetic radiation, comprising:

[0100] Electromagnetic signal capture module for registration: used to obtain electromagnetic signals containing fingerprint information leaked from the hard drive for registration, and obtain the registered electromagnetic signal; the electromagnetic signals containing fingerprint information leaked from the hard drive are obtained from the hard drive through the software-defined radio of the sensor;

[0101] Registration signal enhancement module: used to remove noise interference in the electromagnetic signal during registration, improve the signal-to-noise ratio of the electromagnetic signal, obtain the fingerprint signal, and use it for registration;

[0102] Registration feature extraction module: used to extract feature vectors from fingerprint signals to form positive samples; extract feature vectors from other hard drives in the database as negative samples; the database stores feature vectors from other hard drives, which provide negative samples for training a binary classifier for newly registered hard drives;

[0103] Binary classifier generation module: used to generate a binary classifier corresponding to the hard drive based on positive and negative samples. The binary classifier and hard drive ID corresponding to each hard drive are stored in the device's database.

[0104] Authentication electromagnetic signal capture module: used to query the ID of the hard drive attempting to interact with the host, and obtain the electromagnetic signals leaked by the hard drive for authentication, thus obtaining the authentication electromagnetic signals;

[0105] Authentication signal enhancement module: used to remove noise interference in the authentication electromagnetic signal, improve the signal-to-noise ratio of the electromagnetic signal, and obtain a processed electromagnetic signal. The processed electromagnetic signal includes two parts: a preamble signal for replay detection and a fingerprint signal for authentication.

[0106] Replay detection module: used to extract and verify bit sequences based on preamble signals to detect whether the received electromagnetic signals come from the replay device;

[0107] Authentication Feature Extraction Module: Used to extract feature vectors from the fingerprint signal used for authentication;

[0108] Hard drive authentication module: Used to input feature vectors into a binary classifier associated with the hard drive ID to achieve hard drive authentication.

[0109] The above description is not intended to limit the present invention. It should be noted that, for those skilled in the art, various changes, modifications, additions or substitutions can be made without departing from the essential scope of the present invention, and these improvements and refinements should also be considered within the scope of protection of the present invention.

Claims

1. A hard disk authentication method for preventing replay attacks based on electromagnetic leakage, characterized in that, The methods include device registration and device certification; The device registration process includes the following steps: 1) Obtain the electromagnetic signal containing its fingerprint information leaked from the hard drive for registration, and obtain the registered electromagnetic signal; the electromagnetic signal containing its fingerprint information leaked from the hard drive is obtained from the hard drive through the software-defined radio of the sensor; 2) Remove noise interference from the registered electromagnetic signal, improve the signal-to-noise ratio of the electromagnetic signal, obtain the fingerprint signal, and use it for registration; 3) Extract the feature vector of the fingerprint signal to form positive samples; extract the feature vectors provided by other hard drives in the database as negative samples; the database stores the feature vectors of other hard drives, and the feature vectors provide negative samples for training the binary classifier of the newly registered hard drive; 4) Based on positive and negative samples, generate a binary classifier corresponding to each hard drive. The binary classifier and hard drive ID corresponding to each hard drive are stored in the device's database. The device certification process includes the following steps: 5) Query the ID of the hard drive that is trying to interact with the host, and obtain the electromagnetic signal leaked by the hard drive for authentication; obtain the authentication electromagnetic signal. 6) Remove noise interference from the electromagnetic signal used for authentication and improve the signal-to-noise ratio of the electromagnetic signal to obtain the processed electromagnetic signal. The processed electromagnetic signal includes two parts: a preamble signal for replay detection and a fingerprint signal for authentication. 7) Extract and verify the bit sequence based on the preamble signal to detect whether the received electromagnetic signal comes from the playback device; 8) Extract feature vectors from the fingerprint signal used for authentication; 9) The feature vector is fed into a binary classifier associated with the hard drive ID to achieve hard drive authentication.

2. The hard disk authentication method for preventing replay attacks based on electromagnetic leakage according to claim 1, characterized in that, The sensor used to capture electromagnetic signals includes a software-defined radio, a low-noise amplifier, and an antenna connected in sequence. The electromagnetic signals containing fingerprint information leaked from the hard drive are wirelessly collected from the hard drive through the antenna, and then transmitted to the processor in sequence through the low-noise amplifier and the software-defined radio. The electromagnetic signals containing fingerprint information leaked from the hard drive are generated by a data writing program.

3. The hard disk authentication method for preventing replay attacks based on electromagnetic leakage according to claim 2, characterized in that, In step 2), removing noise interference from the registered electromagnetic signal specifically involves multiplying the electromagnetic signal by a convolution kernel [-0.5, 1, -0.5].

4. The hard disk authentication method for preventing replay attacks based on electromagnetic leakage according to claim 2, characterized in that, In step 2), improving the signal-to-noise ratio of the electromagnetic signal specifically involves: first, processing the denoised electromagnetic signal... Performing a short-time Fourier transform yields the time-frequency spectrum X of the electromagnetic signal: Then, if the sampling rate is Then the frequencies of two adjacent sub-clocks are determined by Separated by discrete Fourier transform frequency points, the sub-clock signal in the electromagnetic signal is distributed in the time spectrum. In the middle, the first At each discrete Fourier transform frequency point, the result of signal enhancement at time t Represented as: ； Next, real-time tracking within a certain frequency range. The maximum value was used to obtain the fingerprint signal.

5. The hard disk authentication method for preventing replay attacks based on electromagnetic leakage according to claim 1, 2, 3, or 4, characterized in that, The principle of extracting the feature vector of the fingerprint signal in step 3) is as follows: First, by analyzing the working mechanism of the internal module of the hard disk during the data writing process, and linking the fingerprint signal with the built-in electronic components of the hard disk, it is known that the amplitude envelope of the fingerprint signal contains the hardware characteristics of the clock module and DRAM module in the hard disk.

6. The hard disk authentication method for preventing replay attacks based on electromagnetic leakage according to claim 5, characterized in that, The extraction of the feature vector of the fingerprint signal specifically involves: quantizing the hardware characteristics from the amplitude envelope of the fingerprint signal using a statistical algorithm, and the resulting statistical features can be used as the feature vector of the fingerprint signal.

7. The hard disk authentication method for preventing replay attacks based on electromagnetic leakage according to claim 5, characterized in that, The positive samples in step 4) are feature vectors extracted from the fingerprint signals leaked from the registered hard drive, and the negative samples are feature vectors from the fingerprint signals of other hard drives provided in the database.

8. The hard disk authentication method for preventing replay attacks based on electromagnetic leakage according to claim 1, 2, 3, 4, 6, or 7, characterized in that, In step 7), the preamble signal is obtained by randomly selecting a one-time bit sequence as a security credential and correspondingly switching the write buffer, thereby introducing randomness into the electromagnetic signal.

9. The hard disk authentication method for preventing replay attacks based on electromagnetic leakage according to claim 8, characterized in that, Step 7) involves detecting whether the received electromagnetic signal originates from the replay device by comparing the bit sequence extracted from the preamble signal with the security credentials to detect replay attacks.

10. A hard disk authentication device for preventing replay attacks based on electromagnetic radiation, characterized in that, include: Electromagnetic signal capture module for registration: used to obtain electromagnetic signals containing fingerprint information leaked from the hard drive for registration, and obtain the registered electromagnetic signal; the electromagnetic signals containing fingerprint information leaked from the hard drive are obtained from the hard drive through the software-defined radio of the sensor; Registration signal enhancement module: used to remove noise interference in the electromagnetic signal during registration, improve the signal-to-noise ratio of the electromagnetic signal, obtain the fingerprint signal, and use it for registration; Registration feature extraction module: used to extract feature vectors from fingerprint signals to form positive samples; extract feature vectors from other hard drives in the database as negative samples; the database stores feature vectors from other hard drives, which provide negative samples for training a binary classifier for newly registered hard drives; Binary classifier generation module: used to generate a binary classifier corresponding to the hard drive based on positive and negative samples. The binary classifier and hard drive ID corresponding to each hard drive are stored in the device's database. Authentication electromagnetic signal capture module: used to query the ID of the hard drive attempting to interact with the host, and obtain the electromagnetic signals leaked by the hard drive for authentication, thus obtaining the authentication electromagnetic signals; Authentication signal enhancement module: used to remove noise interference in the authentication electromagnetic signal, improve the signal-to-noise ratio of the electromagnetic signal, and obtain a processed electromagnetic signal. The processed electromagnetic signal includes two parts: a preamble signal for replay detection and a fingerprint signal for authentication. Replay detection module: used to extract and verify bit sequences based on preamble signals to detect whether the received electromagnetic signals come from the replay device; Authentication Feature Extraction Module: Used to extract feature vectors from the fingerprint signal used for authentication; Hard drive authentication module: Used to input feature vectors into a binary classifier associated with the hard drive ID to achieve hard drive authentication.

Images