A password algorithm artificial intelligence side channel analysis method based on dimension reduction and clustering
By using principal component analysis and clustering algorithms to reduce the dimensionality and cluster the energy traces of cryptographic algorithms, and combining the sliding window gradient value method to divide the energy trace segments, the problems of large data scale and high complexity in existing technologies are solved, and efficient and automated key recovery is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- BEIJING INST OF TECH
- Filing Date
- 2023-10-16
- Publication Date
- 2026-05-29
AI Technical Summary
Existing cryptographic algorithms require large-scale sampling energy trace data, resulting in high analysis complexity and making it difficult to efficiently and automatically recover keys.
Principal component analysis and clustering algorithms are used to reduce the dimensionality and cluster the energy traces of cryptographic algorithms. The energy trace fragments are divided by the sliding window gradient value method to identify the operation type, and the K-medoids algorithm is used for clustering to recover the key.
It enables efficient and automated recovery of keys in cryptographic algorithms, accurately identifies the operation type of energy trace fragments, and reduces the complexity of data analysis.
Smart Images
Figure CN117579244B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a side-channel analysis method for cryptographic algorithms, specifically an artificial intelligence-based side-channel analysis method for cryptographic algorithms based on dimensionality reduction and clustering, belonging to the field of information security cryptography technology. Background Technology
[0002] One of the key technologies in security chips is cryptography. Cryptography is widely regarded as the primary means of maintaining the information security of individuals, society, and the nation, and is the cornerstone of information security. Applying cryptographic technologies and other security measures directly to data is one of the most direct and effective proactive protection methods. However, with the widespread application of cryptography, attackers' methods have also become more diversified. Many devices integrate embedded security applications, such as smart cards, RFID tags, and mobile phones, all of which have become potential targets for side-channel attacks. Attackers can indirectly obtain keys through side-channel analysis.
[0003] Modern cryptanalysis techniques include various methods such as brute-force attacks and mathematical analysis attacks. However, due to the large key spaces and provable security of cryptographic algorithms, these analytical techniques are not applicable to the security assessment of cryptographic chips. One internationally accepted method for assessing the security of cryptographic chips is side-channel analysis. Side-channel analysis primarily targets physical information leaks generated during the encryption process of cryptographic devices, such as power consumption or electromagnetic leakage. By statistically analyzing the correlation between these leaks and the key, the key can be recovered, thereby breaking the cryptographic system. In 1996, Kocher et al. used a timing attack to analyze the implementation of modular exponentiation in public-key cryptographic algorithms. They found that different operations in branch statements resulted in different computation times, and the key was recovered by measuring the encryption time. In 1999, Kocher et al. proposed Simple Energy Analysis (SPA) and Differential Energy Analysis (DPA), laying the foundation for side-channel analysis of cryptographic algorithms.
[0004] Typically, the sampled energy trace data for cryptographic algorithms is large in scale, resulting in high analysis complexity. Therefore, how to extract energy trace features and reduce data dimensionality is a crucial issue. In 2012, Mavroeidis et al., at the "Joint European Conference on Machine Learning and Knowledge Discovery in Databases" (2012:253-268), in their paper "Eigenvector localization and clustering for side-channel attacks on cryptographic hardware devices," proposed applying Principal Component Analysis (PCA) to side-channel analysis, specifically using PCA and K-means clustering. PCA transforms a large amount of energy trace information into a small amount of feature information, reducing algorithm complexity and improving clustering accuracy. While this approach primarily focuses on symmetric cryptographic algorithms, its core ideas can be applied to the analysis of asymmetric cryptographic algorithms to differentiate between different operation types. Summary of the Invention
[0005] The purpose of this invention is to address the problems of large sample size and high analysis complexity of cryptographic algorithms by creatively proposing an artificial intelligence side-channel analysis method for cryptographic algorithms based on dimensionality reduction and clustering. By utilizing principal component analysis and clustering algorithms, the analysis achieves efficient and automated recovery of the algorithm key.
[0006] To achieve the above objectives, the present invention employs the following technical solutions.
[0007] An AI-based side-channel analysis method for cryptographic algorithms based on dimensionality reduction and clustering includes the following steps:
[0008] Step 1: Collect the energy information of the device executing the cryptographic algorithm, analyze the acquired energy trace, and determine the area in the energy trace where the decryption process performs operations related to the secret information.
[0009] Step 2: Analyze the energy trace of the critical computational part, and divide each operation into energy trace segments using a sliding window gradient value-based method.
[0010] Step 3: Combine cryptographic algorithms to perform feature analysis on the divided energy trace fragments and identify the operation type.
[0011] Step 4: Perform dimensionality reduction on the energy trace fragment using principal component analysis, and take the component corresponding to the expected dimension as the principal component for each operation.
[0012] Step 5: Combine the features of the energy trace fragments to estimate the number of clusters obtained from clustering. Use a clustering algorithm to cluster the dimensionality-reduced energy trace fragments to obtain the clustering results.
[0013] Step 6: Analyze the clustering results, determine the operation type represented by each cluster, obtain the operation type corresponding to the energy trace fragment, and finally obtain the secret index sequence.
[0014] Beneficial effects
[0015] The method of this invention can efficiently and automatically analyze the energy traces of cryptographic algorithms to obtain the key-related operation sequences in the algorithm. For cases where there is a small noise segment between two energy trace segments, making it difficult to determine the starting position by finding the peak, this invention designs a method based on sliding window gradient values to determine the starting position of each segment. Attached Figure Description
[0016] Figure 1 This is a flowchart of the method of the present invention;
[0017] Figure 2 This is the complete decryption energy trace map of the U-Shield CRT-RSA algorithm in the embodiment of the method of the present invention;
[0018] Figure 3 These are several energy traces L1-L5 with different characteristics in the embodiments of the method of the present invention;
[0019] Figure 4 This is a partial enlarged view of the energy trace fragment L1 in an embodiment of the method of the present invention;
[0020] Figure 5 This is a magnified view of the energy trace fragment L2 in an embodiment of the method of the present invention;
[0021] Figure 6 This is a diagram showing the division of the energy trace operation interval in an embodiment of the method of the present invention;
[0022] Figure 7 This is a magnified view of the energy trace after moving average in an embodiment of the method of the present invention;
[0023] Figure 8 This is a schematic diagram illustrating the energy trace segmentation effect in an embodiment of the method of the present invention;
[0024] Figure 9 This is a schematic diagram of energy trace fragment features in an embodiment of the method of the present invention;
[0025] Figure 10 This is a schematic diagram showing the classification of average power consumption before and after operation in an embodiment of the method of the present invention;
[0026] Figure 11 This is a clustering result diagram (a) in an embodiment of the method of the present invention;
[0027] Figure 12 This is the clustering result diagram (b) in the embodiment of the method of the present invention;
[0028] Figure 13 This is the clustering result diagram (c) in the embodiment of the method of the present invention. Detailed Implementation
[0029] The detailed steps of the method of the present invention will now be described in conjunction with the accompanying drawings and embodiments.
[0030] Example
[0031] Taking the CRT-RSA algorithm as an example, energy information is collected from the U-shield that implements the algorithm, and the secret information of the algorithm is recovered using the method of this invention.
[0032] like Figure 1 As shown. A cryptographic algorithm-based artificial intelligence side-channel analysis method based on dimensionality reduction and clustering includes the following steps:
[0033] Step 1: Collect the energy information of the device executing the public-key cryptography algorithm, analyze the acquired energy trace, and determine the area in the energy trace where the decryption process performs operations related to the secret information.
[0034] Specifically, after setting up the hardware and software platform, the complete energy trace of the U-shield during the decryption process is collected, such as... Figure 2 As shown.
[0035] According to the principles of the CRT-RSA algorithm, the decryption process involves two modular exponentiation operations. These two operations are related to the algorithm's secret information, where the secret exponent is 1024 bits long, and the exponent for each modular exponentiation operation is 512 bits long. By recovering the exponents from the two modular exponentiation operations, the complete key for the CRT-RSA algorithm can be calculated according to the algorithm's principles.
[0036] Analyzing the energy trace fragments of the modular exponentiation part in the collected energy traces yields the secret exponent sequence. For example... Figure 3 As shown, the energy trace is divided into five segments L1-L5. First, it's necessary to determine which two segments correspond to the execution of the modular exponentiation operation. We will analyze the energy traces at segments L1, L3, and L5. Taking L1 as an example... Figure 4 As shown, the energy trace fragments do not exhibit a clear pattern; however, after magnification, the energy traces at L2 and L4 reveal repetitive and regular operations, such as... Figure 5As shown. Therefore, it is determined that segments L2 and L4 are performing modular exponentiation, which may indicate information leakage. The energy trace analysis method for both modular exponentiation segments is the same. In this embodiment, taking L2 as an example, only the method for recovering the first secret exponent is described. The L4 segment is analyzed using the same method to recover the second secret exponent, thus completing the entire key recovery process.
[0037] Step 2: Analyze the energy trace of the modular exponentiation operation, divide each operation, and obtain energy trace fragments.
[0038] Step 2.1: Use simple energy analysis to determine the energy trace range for each operation.
[0039] According to the implementation principle of the CRT-RSA algorithm, there are two operations in modular exponentiation: squaring and multiplication. These two operations may exhibit different characteristics in the energy trace. Given that the secret exponent length of a single modular exponentiation operation is 512 bits, if all bits of the secret exponent are 0, then squaring is performed 512 times; if all bits of the secret exponent are 1, then both squaring and multiplication are performed 512 times, for a total of 1024 operations. Therefore, the number of operations ranges from 512 to 1024.
[0040] After statistical analysis, such as Figure 6 Each box shown represents one operation, with a total of 745 operations.
[0041] Step 2.2: Divide each operation into segments to obtain energy trace fragments.
[0042] For the division of energy traces, this invention adopts a method based on sliding window gradient difference, which includes two stages: coarse segmentation and fine segmentation.
[0043] First, a coarse segmentation is performed, and the energy trace is then processed using a moving average to reduce noise in the energy trace, such as... Figure 7 As shown. Then, the peaks of the fragments are located to initially determine the location of the operations. At this stage, if each key operation can be clearly segmented, fine segmentation is not necessary; if the energy trace cannot be clearly segmented, the energy trace segmentation continues.
[0044] In this embodiment, the positions of 745 peaks are obtained after coarse segmentation, and these peak positions are denoted as {p1, p2, p3, ..., p...} 745 If the energy trace contains little noise, then each critical operation is clearly segmented at this stage; if the energy trace cannot be clearly segmented, then the following energy trace segmentation process continues.
[0045] In the fine segmentation stage, a window gradient difference-based method is used, based on the peak position p. i To pinpoint the precise location of each operation, use {t1,t2,…,t}.n} represents the energy trace, t j This represents the value of the j-th sampling point; p i Starting from p i to p i Slide to the right on the energy trace within a window size l, where range r This defines the search scope.
[0046] In the fine segmentation stage, a window gradient difference-based method is used, based on the peak position p. i Locate the precise position of each operation, where i = 1, 2, ..., 745. Use {t1, t2, ..., t...} n} represents the energy trace, t j This represents the value of the j-th sampling point. Let p... i Starting from p i to p i +w size Slide to the right on the energy trace within the range, where range r For the search range, w size This refers to the window size. Specifically, you can set the window size to w. size The value is 300. Then, the window gradient difference grad is calculated using the following formula. k :
[0047]
[0048] Where ind represents the current position of the sliding point, t ind This represents the current sampling point, where k ranges from 0 to w. size -1.
[0049] start i The starting position of the i-th operation is shown below:
[0050]
[0051] Finding the termination position of the previous operation is similar to the method described above. First, set the search range. l For r. For p i Starting from p i to p i Slide to the left on the trajectory within the range of -r. Therefore, the termination position of the (i-1)th operation is end. i-1 The calculation is as follows:
[0052]
[0053]
[0054] The above formula is used to calculate the start and end positions of each operation, accurately dividing each energy trace segment.
[0055] Although the segment between any two operations is considered noise, in order to make full use of complete side information, the midpoint between the end position of the previous operation and the start position of the current operation is used as the operation segmentation point (seg). i :
[0056]
[0057] This allows us to pinpoint the location of each operation.
[0058] Step 3: Combine cryptographic algorithms to perform feature analysis on the divided energy trace fragments and identify the operation type.
[0059] observe Figure 9 The energy trace fragments in the data reveal the following differences:
[0060] In terms of the number of sampling points, operations 1, 3, and 8 are slightly larger than operations 2, 4-7, and 9; below the waveform of the energy trace, operations 1, 3, and 8 exhibit dense small peaks with more significant fluctuations, while operations 2, 4-7, and 9 are relatively smooth.
[0061] Based on the bit-by-bit implementation of modular exponentiation in the CRT-RSA algorithm, squaring and multiplication operations are executed alternately. When the key bit is 0, the algorithm performs a squaring operation; when the key bit is 1, both squaring and multiplication operations are performed. Multiplication is only performed after squaring, therefore, two multiplication operations will not be executed consecutively. Accordingly, energy trace fragments shown in 2, 4, 5, 6, 7, and 9 represent squaring operations, while energy trace fragments shown in 1, 3, and 8 represent multiplication operations.
[0062] Step 4: Perform dimensionality reduction on the energy trace fragment using principal component analysis, and take the first p components as the principal components for each operation.
[0063] Step 4.1: Use the divided energy trace segments to construct the data matrix that needs to be reduced in dimensionality.
[0064] If each operation contains the same number of sampling points, several energy trace fragments are directly used as the data matrix to be reduced in dimensionality. In this embodiment, the number of sampling points in the energy trace fragments of each operation is different, so they need to be truncated according to a uniform number of sampling points to form a data matrix. Starting from the beginning position of the operation, the operation fragment is truncated according to the maximum value of the operation width.
[0065] Step 4.2: Use principal component analysis to reduce the dimensionality of the energy trace fragment.
[0066] Principal component analysis is performed on the data matrix to obtain the eigenvalues of each component. Typically, components with eigenvalues greater than 1 are selected as principal components. In this embodiment, the first three components are selected as principal components.
[0067] Step 5: Combine the energy trace fragment features to estimate the number of clusters obtained from clustering, and use the K-medoids algorithm to cluster the dimensionality-reduced energy trace fragments to obtain the clustering results.
[0068] After data dimensionality reduction, an operation containing hundreds of sampling points can be represented by a single three-dimensional coordinate point. Before clustering, the clustering results are predicted, and for each extracted energy trace, the power consumption of the noise segment varies between operations.
[0069] The average power consumption of noise is lower before the operation and higher after the operation. This type of energy trace segment is described as "low at the beginning and high at the end," and is divided into four categories based on the noise before and after the operation, such as... Figure 10 As shown, the patterns are: low at the beginning and high at the end, high at the beginning and high at the end, high at the beginning and low at the end, and low at the beginning and low at the end. Based on this, the squaring operation and the multiplication operation each include 4 categories, and the energy trace fragments are divided into 8 categories.
[0070] Based on the dimensionality-reduced sample distribution characteristics, different clustering algorithms are selected to classify the data. In this embodiment, the K-medoids algorithm is used for clustering. The K-medoids algorithm is an improvement on the K-means algorithm. Its idea is to select the point with the most central position in the cluster as the centroid. The centroid is defined as the point that minimizes the sum of the distances from all other points in the current cluster to the centroid.
[0071] Step 6: Analyze the clustering results, determine the operation type represented by each cluster, obtain the operation type corresponding to the energy trace fragment, and finally obtain the secret index sequence.
[0072] Clustering results as follows Figure 11-13 As shown, (a), (b), and (c) represent three perspectives of the clustering results. It is evident that the sample points in this embodiment are clustered into 8 classes, requiring the determination of the operation type corresponding to each cluster.
[0073] When the key bit is 0, the algorithm performs a squaring operation; when the key bit is 1, it performs both squaring and multiplication operations. Therefore, the number of multiplication operations in the complete operation sequence is less than the number of squaring operations. After clustering, the four clusters with the fewest samples represent multiplication operations, and the remaining four represent squaring operations.
[0074] In this embodiment, the number of clusters after clustering can distinguish between squares. Other algorithms use energy traces to reduce dimensionality and then cluster. If the above methods are not suitable for judging the clustering results, permutations and combinations can be used to try combinations of the correct operating classes. Since the number of multiplication operations is less than that of squaring operations, when the number of samples in the four classes of a combination exceeds half of the operations, the next combination is directly tried.
[0075] Collecting multiple energy traces can significantly improve the accuracy of operation judgment, and a majority voting system is adopted. This embodiment collects 10 energy traces, each with 745 operations. Each energy trace is traversed, and four categories are selected for combination. The votes for each operation corresponding to each sample are accumulated; each operation has a total of 10 votes. When the number of votes for an operation exceeds 5, it is judged as a multiplication operation. The key sequence is recovered based on the judged operation sequence, and an attempt is made to decrypt using this key. If an error occurs, the process returns to step one; if correct, no further attempts are needed.
[0076] After obtaining the complete operation sequence, the secret index is obtained. The complete key can then be calculated based on the algorithm's principles. Since the key calculation process is not the focus of this invention, it will not be described further here.
Claims
1. A cryptographic algorithm-based artificial intelligence side-channel analysis method based on dimensionality reduction and clustering, characterized in that, Includes the following steps: Step 1: Collect energy information from the device executing the cryptographic algorithm, analyze the acquired energy trace, and determine the area in the energy trace where the decryption process performs operations related to the secret information; Step 2: Analyze the energy trace of the critical computational part, and divide each operation into energy trace segments using a sliding window gradient value-based method; Among them, the energy trace is divided using a sliding window gradient difference method, which includes coarse segmentation and fine segmentation; First, a coarse segmentation is performed, and the energy trace is then processed by moving average to reduce noise in the energy trace; Then locate the peaks of the fragment to initially determine the location of the operation; At this stage, if each key operation can be clearly identified, there is no need for fine-grained division; if the energy trace cannot be clearly identified, then the division of the energy trace continues. In the fine segmentation stage, a window gradient difference-based method is used, based on the peak position p. i To pinpoint the precise location of each operation, use {t1, t2, ..., t...} n } represents the energy trace, t j This represents the value of the j-th sampling point; p i Starting from p i to p i + Slide to the right on the energy trace within the range, where range r For the search scope, For window size; Step 3: Combine cryptographic algorithms to perform feature analysis on the divided energy trace fragments and identify the operation type; Step 4: Perform dimensionality reduction on the energy trace fragment using principal component analysis, and take the component corresponding to the expected dimension as the principal component for each operation; Step 5: Combine the features of the energy trace fragments to estimate the number of clusters obtained from clustering; use a clustering algorithm to cluster the dimensionality-reduced energy trace fragments to obtain the clustering results; Step 6: Analyze the clustering results, determine the operation type represented by each cluster, obtain the operation type corresponding to the energy trace fragment, and finally obtain the secret index sequence.
2. The cryptographic algorithm-based artificial intelligence side-channel analysis method according to claim 1, characterized in that, Calculate the window gradient difference using the following formula : Where ind represents the current position of the sliding point. This represents the current sampling point, where k ranges from 0 to... -1; start i The starting position of the i-th operation is shown below: To find the termination position of the previous operation, first, set the search range. l For r; with p i Starting from p i to p i Slide to the left on the trajectory within the range of −r; therefore, the termination position of the i-1th operation. The calculation is as follows: ， The above formula is used to calculate the start and end positions of each operation, accurately dividing each energy trace segment; Use the midpoint between the end position of the previous operation and the start position of the current operation as the operation split point. : This allows us to pinpoint the location of each operation.
3. The cryptographic algorithm-based artificial intelligence side-channel analysis method according to claim 1, characterized in that, Step 4 includes the following steps: Step 4.1: Use the pre-divided energy trace segments to construct the data matrix that needs dimensionality reduction; If each operation contains the same number of sampling points, then several energy trace fragments are directly used as the data matrix to be reduced in dimensionality; starting from the beginning of the operation, the operation fragments are truncated according to the maximum value of the operation width. Step 4.2: Dimensionality reduction of the energy trace fragment using principal component analysis; Principal component analysis was performed on the data matrix to obtain the eigenvalues of each component.
4. The cryptographic algorithm-based artificial intelligence side-channel analysis method according to claim 3, characterized in that, In step 4.2, the components with eigenvalues greater than 1 are selected as principal components.
5. The cryptographic algorithm-based artificial intelligence side-channel analysis method according to claim 3, characterized in that, In step 5, the K-medoids algorithm is used to cluster the dimensionality-reduced energy trace fragments to obtain the clustering results.