Side channel attack detection method and system based on deep learning

Abstract

The present application discloses a side channel attack detection method and system based on deep learning, the method comprising: deploying a side channel analysis detection system to capture the side channel timing data during encryption operation in real time; inputting the side channel timing data into an optimized deep learning model to identify abnormal side channel activities; and dynamically adjusting the execution of the encryption algorithm based on the abnormal side channel activities. The disclosed embodiment can identify slight deformations in the presence of random delay protection measures, thereby accurately predicting the key execution sequence of the encryption algorithm, with stronger adaptability and higher detection accuracy.

Description

Technical Field

[0001] The present application relates to the technical field of side channel attack detection, and specifically to a side channel attack detection method and system based on deep learning. Background Art

[0002] With the rapid development of information technology and the widespread application of digital currency, especially the increasing popularity of encrypted payment systems such as the digital RMB (DC / EP) launched by China, payment security has become an important issue that needs to be solved urgently. The digital currency payment system has been favored by the majority of users for its convenience and speed, but at the same time, its security also faces many challenges. Among them, side channel attacks, as a new type of attack method, indirectly obtain encrypted information by analyzing the physical demonstration (such as time, power consumption, electromagnetic waves, etc.) during the execution of hardware, posing a serious threat to the security of the payment system.

[0003] In order to effectively protect against side-channel attacks during digital RMB payment, the traditional method is to use various randomization techniques in the system, such as random delay insertion, to disrupt attackers' access to information. However, although the above-mentioned technologies can increase the difficulty of attacks for attackers, they still have many defects. First, the means of adversarial attack are highly predictable, and attackers can crack the aforementioned protection measures through complex statistical analysis methods. Secondly, existing technologies cannot fully cover all types of side-channel attacks, especially for more advanced and covert means of attack, and their protection effect is limited. In addition, effective defense measures often require additional hardware support or computing resources, which can easily lead to a decrease in the efficiency of the payment system and increase operating costs. Summary of the invention

[0004] In view of this, the present application provides a side channel attack detection method and system based on deep learning, which can identify slight deformations in the presence of random delay protection measures, thereby accurately predicting the key execution sequence of the encryption algorithm, with stronger adaptability and higher detection accuracy.

[0005] The present application provides a side channel attack detection method based on deep learning, the method comprising:

[0006] Deploy a side channel analysis detection system to capture side channel timing data during cryptographic operations in real time;

[0007] Inputting the side channel timing data into an optimized deep learning model to identify abnormal side channel activities;

[0008] Based on the anomalous side channel activity, execution of the cryptographic algorithm is dynamically adjusted.

[0009] Optionally, the side channel timing data includes energy consumption patterns and time gaps between execution processes.

[0010] Optionally, the step of inputting the side channel data into a trained deep learning model to identify abnormal side channel activities comprises:

[0011] Obtain historical side channel timing data;

[0012] Based on the historical side channel time series data, construct a training data set and a verification data set;

[0013] Using the training data set to train a preset deep learning model to obtain the trained deep learning model;

[0014] The validation set is then used to validate and optimize the trained deep learning model to obtain an optimized deep learning model.

[0015] Optionally, the acquiring historical side channel time series data includes:

[0016] Obtain known normal data samples and attack data samples, annotate the data, and mark the data as normal (0) and abnormal (1).

[0017] Optionally, the acquiring of historical side channel time series data further includes:

[0018] Random delay technology is used to simulate the random interference of side channel data during propagation or acquisition, and to generate side channel data samples with random delay.

[0019] Optionally, the dynamically adjusting execution of the encryption algorithm based on the abnormal side channel activity, the step of updating the deep learning model comprises:

[0020] Based on real-time capture of side channel timing data during encryption operations, an online learning or incremental learning algorithm is used to dynamically update the parameters of the deep learning model to identify unknown emerging side channel attacks.

[0021] Optionally, inputting the side channel timing data into an optimized deep learning model to identify abnormal side channel activities includes:

[0022] Nonlinear expected classification line formation thresholds are calculated to discriminate data to identify known and unknown emerging side channel attacks.

[0023] Optionally, dynamically adjusting execution of an encryption algorithm based on the abnormal side channel activity includes:

[0024] When abnormal side channel activity is identified, a random or pseudo-random method is used to change the execution sequence of the encryption algorithm; or different parameters in the encryption algorithm are randomly selected, different keys are used, or random encryption delays are introduced.

[0025] Optionally, the side channel timing data is input into an optimized deep learning model to identify abnormal side channel activities, and the deep learning model includes:

[0026] An adaptive learning algorithm is used to optimize the learning rate and layer weight values ​​of the deep learning model.

[0027] Correspondingly, the present application provides a side channel attack detection system based on deep learning, comprising:

[0028] An acquisition module for deploying a side-channel analysis detection system to capture side-channel timing data during cryptographic operations in real time;

[0029] An analysis module, configured to input the side channel timing data into an optimized deep learning model to identify abnormal side channel activities;

[0030] An adjustment module is used to dynamically adjust the execution of the encryption algorithm based on the abnormal side channel activity.

[0031] The present application provides a side channel attack detection method and system based on deep learning, deploys a side channel analysis detection system for real-time capture of side channel timing data during encryption operations, and real-time monitoring of the digital RMB payment processing process to detect and defend against side channel attacks; the side channel timing data is input into an optimized deep learning model to process time series data and identify potential attack features, thereby preventing and identifying side channel attacks; in addition, the use of a deep learning model can identify subtle deformations in the presence of random delay protection measures, thereby accurately predicting the key execution sequence of the encryption algorithm, with greater adaptability and higher detection accuracy; based on abnormal side channel activity, the execution of the encryption algorithm is dynamically adjusted to disrupt the attacker's timing analysis, with greater security. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 A schematic diagram of a side channel attack detection method based on deep learning provided in an embodiment of the present application;

[0034] Figure 2 A schematic diagram of the structure of a side-channel attack detection system based on deep learning provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0036] It should be clear that the following embodiments of the present disclosure are described by specific specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other in the absence of conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0037] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0038] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The drawings only show components related to the present disclosure rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0039] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0040] Embodiment 1

[0041] A side channel attack is any attack based on information gained from the implementation of a computer system, rather than weaknesses in the implementation algorithm itself. Side channel attacks (SCA) are very sophisticated reverse engineering attacks against computer cryptographic systems. Side channel attacks use measurements of differences in the physical processes of a computer (such as power consumption and heat dissipation) to extract secret information (such as encryption keys) from a cryptographic algorithm. Side channel attacks attempt to reveal secret information based on the physical properties of a cryptographic system, rather than exploiting theoretical weaknesses in an implemented cryptographic algorithm.

[0042] A power analysis attack begins by precisely measuring the power consumption of the target device multiple times. The power consumption of an unprotected implementation shows a unique power consumption curve depending on the key used in the algorithm. By matching the profile with the power profile predicted with each possible key, the key can be inferred without accessing the data in the system. Side channel attacks typically target computer hardware, causing perturbations to cache memory and then observing cache access patterns or intentionally manipulating the functioning of branch predictors and illegally accessing sensitive memory addresses.

[0043] Therefore, in the digital RMB-based payment system, encryption algorithms are used to encrypt sensitive data, and randomness and noise are introduced to interfere with side-channel attackers in analyzing the pattern of encryption operations. Differential concealment methods are used to disperse encryption keys and sensitive data, reducing the possibility of attackers obtaining complete information.

[0044] Figure 1 A flow chart of a side channel attack detection method based on deep learning is provided in an embodiment of the present disclosure. The side channel attack detection method based on deep learning includes steps S1 to S3.

[0045] S1. Deploy a side channel analysis detection system to capture side channel timing data during cryptographic operations in real time.

[0046] In this disclosure, side channel timing data refers to timing data obtained by monitoring and analyzing the physical characteristics of a device (such as power consumption, electromagnetic radiation, sound, etc.), which can reveal the running status and operation mode of the device. In a side channel attack, an attacker may use the timing data to steal sensitive information.

[0047] Specifically, specific sensors and monitoring devices, such as high-precision timers and energy monitoring sensors, are deployed to collect key physical information.

[0048] Optionally, the collected side channel timing data is filtered, denoised, and standardized; features are extracted from the preprocessed data, the features including energy consumption patterns and time gaps between execution processes, for describing the side channel information.

[0049] Optionally, the side channel timing data includes energy consumption patterns and time gaps between execution processes; wherein, the energy consumption patterns can identify abnormal patterns by analyzing changes in energy consumption of electronic devices used to run the system when performing encryption operations, and the abnormal patterns may be related to side channel attacks; the time gaps between execution processes are used to monitor tiny time differences between operating processes, especially operations related to sensitive data, which helps to identify potential side channel attacks.

[0050] S2. Input the side channel timing data into the optimized deep learning model to identify abnormal side channel activities.

[0051] Optionally, the deep learning model can use a convolutional neural network (CNN) or a recurrent neural network (RNN) to process time series data and identify potential attack features. Among them, the convolutional neural network (CNN) is suitable for extracting local features of data, while the recurrent neural network (RNN) can capture the time dependency in the sequence.

[0052] Optionally, the side channel data is input into a trained deep learning model to identify abnormal side channel activities, and the training steps of the deep learning model include:

[0053] Obtain historical side channel timing data; wherein, the historical side channel timing data uses random delay technology to simulate the random interference of the side channel data during the propagation or collection process, generates side channel data samples containing random delays, and uses a large number of side channel data samples containing random delays for training to enhance the model's adaptability to randomness.

[0054] Based on the historical side channel time series data, a training dataset and a validation dataset are constructed; the training dataset is used to train the model, while the validation dataset is used to evaluate the performance of the model.

[0055] The preset deep learning model is trained using the training data set to obtain a trained deep learning model; during the training process, various optimization algorithms, such as gradient descent, Adam, etc., can be used to accelerate the training and improve the performance of the model.

[0056] Then, the validation set is used to validate and optimize the trained deep learning model to obtain the optimized deep learning model. The performance of the model is evaluated by calculating indicators such as accuracy, recall, and F1 score. According to the validation results, the parameters of the model can be tuned, such as increasing or decreasing the number of network layers, the weight value of the layers, and adjusting the learning rate, to optimize the performance of the model.

[0057] Optionally, obtain historical side channel timing data, including:

[0058] Obtain known normal data samples and attack data samples, annotate the data, mark the data as normal (0) and abnormal (1), and calculate the chi-square value between each feature and category: The chi-square value here is used to measure the correlation between the feature and the category, and is used to train the chi-square test model. The trained chi-square test model is used to analyze and identify the physical characteristic data collected in real time, and the abnormal side channel activity is judged according to the threshold, triggering the alarm mechanism.

[0059] Optionally, the side channel timing data is fed into an optimized deep learning model to identify anomalous side channel activity, including:

[0060] Calculate the threshold of the nonlinear expected classification line to distinguish data to identify known and unknown emerging side channel attacks. This technology is a technology that calculates the threshold of the nonlinear expected classification line. It trains machine learning models to distinguish known attacks, unknown attacks, and false positives of no-attack data, and selects the optimal threshold based on the probability value output by the model to achieve accurate security detection.

[0061] S3. Dynamically adjust the execution of encryption algorithms based on anomalous side-channel activity.

[0062] Optionally, dynamically adjust execution of cryptographic algorithms based on anomalous side channel activity, including:

[0063] When anomalous side channel activity is identified, changing the execution sequence of the cryptographic algorithm using a random or pseudo-random method; wherein the above method can be achieved by reordering the execution steps of the cryptographic algorithm, adding additional cryptographic steps, or removing steps;

[0064] Or randomly select different parameters in the encryption algorithm, use different keys, or introduce random encryption delays to introduce randomization elements to increase complexity during the execution of the encryption algorithm.

[0065] Optionally, a flexible encryption processing strategy is adopted, that is, a mechanism that automatically adjusts the encryption processing strategy according to trigger conditions, which involves dynamic configuration and adjustment of encryption algorithms, key management, encryption modes, etc. In addition, it is necessary to evaluate the impact of encryption algorithm adjustments on user experience to ensure that the adjustment measures minimize the impact on payment processing speed while improving security.

[0066] Optionally, based on the abnormal side channel activity, the execution of the encryption algorithm is dynamically adjusted, and the updating steps of the deep learning model include:

[0067] Based on the real-time capture of side channel timing data during encryption operations, online learning or incremental learning algorithms are used to dynamically update the parameters of the deep learning model to identify unknown emerging side channel attacks.

[0068] Specifically, online learning allows deep learning models to update their parameters in real time to adapt to new data, while incremental learning strategies focus on gradually introducing real-time data to continue improving the model while retaining previous learning results. This ensures that the deep learning model can continuously optimize its performance when continuously receiving new data, and enhances its ability to process new data by gradually updating model parameters, thereby maintaining the stability of the model while improving its accuracy and efficiency in identifying abnormal activities in the side channel.

[0069] Optionally, the introduction of dynamic data augmentation technology is crucial to improving the ability of deep learning models to learn and adapt to unknown emerging side channel attacks as they continue to receive new data. This technology transforms and enhances input data in real time to generate more diverse training samples, thereby increasing the generalization ability of the model.

[0070] For example, dynamic data enhancement techniques such as random noise addition, timing offset, frequency conversion, etc. can be used to simulate unknown side channel attack patterns. This can not only help the model better learn and understand the characteristics of attack behaviors, but also improve the model's ability to identify unknown attacks.

[0071] In addition, dynamic data enhancement technology can also be combined with online learning or incremental learning strategies. As new data is continuously input, the model can be enhanced and trained with new data in real time, thereby continuously optimizing its performance. The above combination enables the model to not only adapt to data changes, but also quickly learn and respond to unknown attack patterns.

[0072] Optionally, the side channel timing data is input into an optimized deep learning model to identify abnormal side channel activities, and the deep learning model includes:

[0073] An adaptive learning algorithm is used to optimize the learning rate and layer weight values ​​of the deep learning model.

[0074] Specifically, when the side channel time series data is input into the optimized deep learning model to identify abnormal side channel activities, the learning rate and layer weight values ​​of the deep learning model can be further optimized by adopting an adaptive learning algorithm. The above-mentioned adaptive learning algorithm can dynamically adjust the learning rate according to the performance of the model during the training process to help the model converge to the optimal solution more efficiently. At the same time, the algorithm can also automatically adjust the weight values ​​of different layers to optimize the performance of the model on different features, thereby improving the model's recognition accuracy of abnormal activities in side channel time series data.

[0075] Embodiment 2

[0076] Figure 2A schematic diagram of a side channel attack detection system based on deep learning provided in an embodiment of the present disclosure is provided. The side channel attack detection system 200 based on deep learning includes:

[0077] A collection module 201, used to deploy a side channel analysis detection system to capture side channel timing data during encryption operations in real time;

[0078] An analysis module 202, configured to input the side channel timing data into an optimized deep learning model to identify abnormal side channel activities;

[0079] The adjustment module 203 is used to dynamically adjust the execution of the encryption algorithm based on abnormal side channel activities.

[0080] In some embodiments, the acquisition module 201 includes:

[0081] Side channel timing data includes energy consumption patterns and time gaps between execution flows.

[0082] In some embodiments, the analysis module 202 includes:

[0083] A model training module is used to obtain historical side channel timing data; based on the historical side channel timing data, construct a training data set and a verification data set; use the training data set to train a preset deep learning model to obtain the trained deep learning model; and then use the verification set to verify and optimize the trained deep learning model to obtain an optimized deep learning model.

[0084] In some embodiments, the model training module includes:

[0085] The data processing module is used to obtain known normal data samples and attack data samples, annotate the data, and mark the data as normal (0) and abnormal (1).

[0086] In some embodiments, the model training module includes:

[0087] The data processing module is used to simulate the random interference of the side channel data during the propagation or collection process by using the random delay technology, and generate the side channel data samples containing random delay.

[0088] In some embodiments, the adjustment module 203 includes:

[0089] The model optimization module is used to dynamically update the parameters of the deep learning model based on the real-time capture of side channel timing data during encryption operations, using an online learning or incremental learning algorithm to identify unknown emerging side channel attacks.

[0090] In some embodiments, the model training module includes:

[0091] Attack identification module that calculates nonlinear expected classification line formation thresholds to discriminate data to identify known and unknown emerging side channel attacks.

[0092] In some embodiments, the adjustment module 203 includes:

[0093] An encryption adjustment module is used to change the execution sequence of the encryption algorithm by random or pseudo-random methods when abnormal side channel activities are identified; or randomly select different parameters in the encryption algorithm, use different keys, or introduce random encryption delays.

[0094] In some embodiments, the adjustment module 203 includes:

[0095] The model optimization module is used to optimize the learning rate and layer weight values ​​of the deep learning model using an adaptive learning algorithm.

[0096] The basic principles of the present disclosure are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present disclosure are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, and are not limitations. The above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0097] In the present disclosure, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. The block diagrams of the devices, devices, equipment, and systems involved in the present disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagram. As will be appreciated by those skilled in the art, these devices, devices, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including", "comprising", "having", etc. are open words, referring to "including but not limited to", and can be used interchangeably with them. The words "or" and "and" used here refer to the words "and / or" and can be used interchangeably with them, unless the context clearly indicates otherwise. The words "such as" used here refer to the phrase "such as but not limited to", and can be used interchangeably with them.

[0098] Additionally, as used herein, "or" used in a list of items beginning with "at least one" indicates a separate list, so that, for example, a list of "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not mean that the example described is preferred or better than other examples.

[0099] It should also be noted that in the system and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0100] Various changes, substitutions, and modifications of the techniques described herein may be made without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of the present disclosure is not limited to the specific aspects of the processes, machines, manufactures, compositions of events, means, methods, and actions described above. Currently existing or later to be developed processes, machines, manufactures, compositions of events, means, methods, or actions that perform substantially the same functions or achieve substantially the same results as the corresponding aspects described herein may be utilized. Thus, the appended claims include such processes, machines, manufactures, compositions of events, means, methods, or actions within their scope.

[0101] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Therefore, the present disclosure is not intended to be limited to the aspects shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

[0102] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims

1. A side channel attack detection method based on deep learning, characterized in that: The method comprises: Deploy a side channel analysis detection system to capture side channel timing data during encryption operations in real time; the side channel timing data includes energy consumption patterns and time gaps between execution processes, where the time gaps between execution processes are used to monitor small time differences between operation processes; Inputting the side channel timing data into an optimized deep learning model to identify abnormal side channel activities; Dynamically adjust execution of a cryptographic algorithm based on the anomalous side channel activity; The inputting the side channel time series data into the optimized deep learning model to identify abnormal side channel activities includes: calculating a threshold for forming a nonlinear expected classification line, distinguishing known attacks, unknown attacks, and false positive no-attack data by training a machine learning model, and selecting an optimal threshold based on a probability value output by the model to achieve accurate security detection; The dynamically adjusting the execution of the encryption algorithm based on the abnormal side channel activity includes: when the abnormal side channel activity is identified, changing the execution sequence of the encryption algorithm by a random or pseudo-random method; or randomly selecting different parameters in the encryption algorithm, using different keys, or introducing random encryption delays; Evaluate the impact of cryptographic algorithm changes on user experience and ensure that the changes improve security while minimizing the impact on payment processing speed; The adopting of a random or pseudo-random method to change the execution sequence of the encryption algorithm includes: reordering the execution steps of the encryption algorithm, adding additional encryption steps or deleting steps; The random selection of different parameters in the encryption algorithm, the use of different keys or the introduction of random encryption delays include: a mechanism for automatically adjusting the encryption processing strategy according to trigger conditions, including dynamic configuration and adjustment of encryption algorithms, key management, and encryption modes.

2. The side channel attack detection method based on deep learning according to claim 1, characterized in that: The side channel timing data is input into the optimized deep learning model to identify abnormal side channel activities, and the training steps of the deep learning model include: Obtain historical side channel timing data; Based on the historical side channel time series data, construct a training data set and a verification data set; Using the training data set to train a preset deep learning model to obtain the trained deep learning model; The validation set is then used to validate and optimize the trained deep learning model to obtain an optimized deep learning model.

3. The side channel attack detection method based on deep learning according to claim 2 is characterized in that: The obtaining of historical side channel time series data includes: Obtain known normal data samples and attack data samples, annotate the data, and mark the data as normal (0) and abnormal (1).

4. The side channel attack detection method based on deep learning according to claim 2, characterized in that: The acquiring of historical side channel time series data further includes: Random delay technology is used to simulate the random interference of side channel timing data during the propagation or acquisition process, and to generate side channel timing data samples with random delay.

5. The side channel attack detection method based on deep learning according to claim 1, characterized in that: The step of dynamically adjusting the execution of the encryption algorithm based on the abnormal side channel activity, and updating the deep learning model includes: Based on real-time capture of side channel timing data during encryption operations, an online learning or incremental learning algorithm is used to dynamically update the parameters of the deep learning model to identify unknown emerging side channel attacks.

6. The side channel attack detection method based on deep learning according to claim 1, characterized in that: The side channel timing data is input into an optimized deep learning model to identify abnormal side channel activities, wherein the deep learning model includes: An adaptive learning algorithm is used to optimize the learning rate and layer weight values ​​of the deep learning model.

7. A side channel attack detection system based on deep learning, characterized in that: include: An acquisition module for deploying a side-channel analysis detection system to capture side-channel timing data during cryptographic operations in real time; An analysis module, configured to input the side channel timing data into an optimized deep learning model to identify abnormal side channel activities; an adjustment module, configured to dynamically adjust execution of an encryption algorithm based on the abnormal side channel activity; The dynamically adjusting the execution of the encryption algorithm based on the abnormal side channel activity includes: when the abnormal side channel activity is identified, changing the execution sequence of the encryption algorithm by a random or pseudo-random method; or randomly selecting different parameters in the encryption algorithm, using different keys, or introducing random encryption delays; Evaluate the impact of cryptographic algorithm changes on user experience and ensure that the changes improve security while minimizing the impact on payment processing speed; The adopting of a random or pseudo-random method to change the execution sequence of the encryption algorithm includes: reordering the execution steps of the encryption algorithm, adding additional encryption steps or deleting steps; The random selection of different parameters in the encryption algorithm, the use of different keys or the introduction of random encryption delays include: a mechanism for automatically adjusting the encryption processing strategy according to trigger conditions, including dynamic configuration and adjustment of encryption algorithms, key management, and encryption modes.

Images