A high spatial precision electromagnetic fault injection method for cryptographic chips

Abstract

The present invention discloses a high spatial precision electromagnetic fault injection method for cryptographic chips, and relates to the field of integrated circuit security and electromagnetic fault injection technology. Aiming at the problem that the current electromagnetic fault injection technology is insufficient in spatial precision and cannot accurately control the position of fault injection, resulting in limited test effect, the present invention adjusts the spatial position of the electromagnetic probe according to the physical structure of the target chip and the characteristics of the integrated circuit, including the precise positioning of the three dimensions of X, Y, and Z and the angle with the chip surface, so that the electromagnetic fault injection acts more accurately on the key area of ​​the chip, thereby improving the pertinence and efficiency of the fault injection; at the same time, the erroneous ciphertext output by the same key under different input plaintexts is collected, and the key information of the cryptographic chip is cracked by using differential fault analysis (DFA), which helps the cryptographic chip designer to timely improve the protection measures for electromagnetic fault injection and enhance the security of the chip.

Description

Technical Field

[0001] The invention relates to the technical field of integrated circuit security and electromagnetic fault injection, and in particular to a high spatial precision electromagnetic fault injection method for a cryptographic chip. Background Art

[0002] With the rapid development of semiconductor processes and integrated circuit technology, the integration of integrated circuits has been continuously improved, and the functions have become more complex. Integrated circuits play a fundamental and core role in many key fields, such as electronic products, network communications, medical electronics, aerospace, and military. However, this has also brought about increasingly prominent information security issues. As a key component of information security, cryptographic chips are responsible for implementing encryption algorithms and are therefore vulnerable to physical attacks. The protection of cryptographic chips has become a research focus.

[0003] The tests for cryptographic chips are mainly divided into side channel tests and fault injection tests. Fault injection tests introduce fault disturbances during the execution of encryption algorithms on the chip to obtain faulty ciphertext outputs, which are then analyzed to obtain sensitive information such as keys. The existing electromagnetic fault injection (EMFI) method, although it does not require contact with the chip and can perform spatial positioning tests, has great limitations in terms of spatial accuracy. Current research is still focused on the positioning of sensitive positions on the plane, and the sensitive positions obtained by positioning only on the plane make it difficult to further improve the effectiveness of injection. Therefore, the existing technology has not yet considered the differences in the physical structure of the target chip, nor has it adjusted the spatial position of the probe, and it is impossible to achieve electromagnetic fault injection with high spatial accuracy, which may cause the electromagnetic fault injection test to fail due to insufficient spatial accuracy, greatly increasing the number of subsequent tests and extending the test cycle.

[0004] There is currently no effective way to solve this problem. Summary of the invention

[0005] In view of the problem that the current electromagnetic fault injection technology is insufficient in spatial accuracy and cannot accurately control the position of fault injection, resulting in limited test effect, the present invention provides a high spatial accuracy electromagnetic fault injection method for a cryptographic chip, comprising the following steps:

[0006] Inputting plain text into the cryptographic chip to be tested, and obtaining a first ciphertext output by the cryptographic chip to be tested;

[0007] Select a target bit in the first ciphertext;

[0008] Determine sensitive position data that can invert the value of the target bit, wherein the sensitive position data is the three-dimensional coordinates of the electromagnetic probe and the horizontal angle between the electromagnetic probe and the cryptographic chip to be tested;

[0009] An electromagnetic probe is set according to the sensitive position data, an electromagnetic pulse is emitted to the cryptographic chip to be tested, a second ciphertext output by the cryptographic chip to be tested is obtained, and a value of the target bit is monitored;

[0010] If the value of the target bit is reversed, proceed to the next step; if the value of the target bit is not reversed, re-determine the sensitive position data;

[0011] Save the data vector, which includes the first ciphertext and the second ciphertext, change the input plaintext, select the next target bit, repeat all the above operations, and proceed to the next step if every bit in the second ciphertext has been traversed;

[0012] The differential fault analysis algorithm is used to analyze the saved data vectors and crack the key information of the cryptographic chip to be tested.

[0013] Furthermore, before inputting the plain text into the cryptographic chip to be tested and obtaining the first ciphertext output by the cryptographic chip to be tested, the method further includes:

[0014] Prepare an electromagnetic fault injection experimental device, which specifically includes a host computer, an electromagnetic pulse generator, an electromagnetic probe, an XYZ direction three-axis displacement platform and a password chip to be tested; the host computer is used to control and operate various devices in the experimental platform, and use a serial port to achieve communication with the password chip to be tested, the pulse generator is used to generate an electromagnetic pulse signal, the electromagnetic probe is used to generate a high-voltage transient electromagnetic field, and the XYZ direction three-axis displacement platform is used to accurately adjust the relative position of the electromagnetic probe and the password chip to be tested;

[0015] Fix the password chip to be tested on the three-axis displacement platform in the XYZ direction.

[0016] Furthermore, the method for confirming the X and Y coordinates in the three-dimensional coordinates of the electromagnetic probe is as follows: the cryptographic chip to be tested is divided into grids, and at each grid, each bit in the ciphertext is taken as a target, and the following operations are performed:

[0017] Assume that the coordinates of the current grid are (X, Y), place the electromagnetic probe at a height H above the grid, H>0, and emit electromagnetic pulses to the password chip to be tested at the same angle. Repeat the emission process several times, and count the number of times the value of the target bit is reversed after each emission;

[0018] Calculate the probability P1 of the target bit value being reversed according to the number of reversals;

[0019] If the probability P1 is greater than the preset value P 10, the X and Y values ​​of the coordinates of the current grid are the X and Y coordinate values ​​of the sensitive position data of the target bit; otherwise, the first two steps are performed on the next grid; until the X and Y coordinate values ​​of the sensitive position data corresponding to each bit in the ciphertext are determined.

[0020] Furthermore, the method for confirming the Z coordinate in the three-dimensional coordinates of the electromagnetic probe is as follows:

[0021] At the X and Y coordinates of the sensitive position corresponding to the target bit, the distance between the electromagnetic probe and the password chip to be tested is adjusted, and the electromagnetic pulse transmission operation is performed several times at the same angle, and the number of times the value of the target bit is reversed after each transmission is counted;

[0022] Calculate the probability P2 of the target bit value being reversed according to the number of reversals;

[0023] If the probability P2 is greater than the preset value P 20 , the Z value of the coordinate of the current grid is the Z coordinate value of the sensitive position data of the target bit; otherwise, the first two steps are performed on the next grid; until the Z coordinate value of the sensitive position data corresponding to each bit in the ciphertext is determined.

[0024] Furthermore, the angle between the electromagnetic probe and the password chip to be tested is confirmed by:

[0025] At the X, Y, and Z coordinates corresponding to the target bit, the angle between the electromagnetic probe and the cryptographic chip to be tested is adjusted, and the electromagnetic pulse transmission operation is performed several times, and the number of times the value of the target bit is reversed after each transmission is counted;

[0026] Calculate the probability P3 of the target bit value being reversed according to the number of reversals;

[0027] If the probability P3 is greater than the preset value P 30 , then the current angle between the electromagnetic probe and the cryptographic chip to be tested is the angle value of the sensitive position data of the target bit; otherwise, perform the first two steps on the next grid; until the angle value of the sensitive position data corresponding to each bit in the ciphertext is determined.

[0028] Furthermore, P1 <P2<P3,P 10 <P 20 <P 30 .

[0029] Furthermore, the distance between the electromagnetic probe and the password chip to be tested is adjusted as follows: the electromagnetic probe moves relative to the password chip to be tested, traversing the spatial position vertically above the (X, Y) coordinate in a manner from far to near.

[0030] Furthermore, the angle between the electromagnetic probe and the password chip to be tested is adjusted to: with the (X, Y, Z) coordinate as the center of the sphere, traverse the angle at which the electromagnetic pulse can be emitted to the password chip to be tested.

[0031] Furthermore, the differential fault analysis algorithm is used to analyze the saved data vector to crack the key information of the cryptographic chip to be tested, specifically:

[0032] Obtain a set of data vectors, including a first ciphertext and a second ciphertext;

[0033] Calculate the difference between the first ciphertext and the second ciphertext in each set of data vectors to obtain a candidate fault set;

[0034] An intersection operation is performed on the candidate fault set to obtain the key of the cryptographic chip to be tested.

[0035] The embodiments of the present invention have the following technical effects:

[0036] First, the present invention adjusts the spatial position of the electromagnetic probe according to the physical structure and integrated circuit characteristics of the target chip, including precise positioning in the three dimensions of X, Y, and Z and the angle with the chip surface, so that the electromagnetic fault injection acts more accurately on the key area of ​​the chip, thereby improving the pertinence and effectiveness of the fault injection;

[0037] Secondly, by precisely controlling the position and angle of the electromagnetic probe, the electromotive force generated by the injected electromagnetic pulse is adjusted, and the electromotive force is a key factor affecting the effectiveness of the injection. The present invention can identify sensitive locations that can effectively improve the success rate of fault injection, which not only reduces the number of blind tests in later tests, but also significantly improves the overall test efficiency and accuracy;

[0038] Thirdly, the present invention collects the erroneous ciphertexts output by the same key under different input plaintexts, and uses differential fault analysis (DFA) to crack the key information of the cryptographic chip to be tested, which helps cryptographic chip designers to improve protection measures in time against electromagnetic fault injection and enhance the security of the chip. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 It is a flow chart of a high spatial precision electromagnetic fault injection method for a cryptographic chip provided by an embodiment of the present invention;

[0041] Figure 2 Schematic diagram of plane coordinates of sensitive positions of a cryptographic chip provided by an embodiment of the present invention;

[0042] Figure 3 is a schematic diagram of the relationship between the coil and the electromagnetic field provided by an embodiment of the present invention;

[0043] Figure 4 It is a structural schematic diagram of a high spatial precision electromagnetic fault injection system for a cryptographic chip provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0045] In traditional electromagnetic fault injection methods, usually only the two-dimensional spatial adjustment on the X and Y axes is focused. Although this method can achieve fault injection to a certain extent, its effectiveness is often limited by spatial accuracy, and it is difficult to achieve a qualitative leap.

[0046] In order to overcome this problem, the present invention introduces the height adjustment and angle adjustment of the Z axis, realizing the three-dimensional spatial positioning of the electromagnetic probe and the precise orientation relative to the cryptographic chip. Through this multi-dimensional adjustment, the present invention not only optimizes the coupling efficiency between the electromagnetic field and the chip circuit, but also significantly improves the accuracy and success rate of fault injection. This comprehensive three-dimensional spatial adjustment strategy, combined with angle optimization, enables the fault injection technology to act on the target chip more finely and efficiently, providing a more effective technical means for the security assessment and improvement of protective measures of the cryptographic chip. Through the method of the present invention, electromagnetic fault injection into the cryptographic chip can be achieved with higher accuracy within a fewer number of tests, thereby greatly improving the efficiency and quality of security testing.

[0047] Example 1

[0048] The present invention proposes a high spatial precision electromagnetic fault injection method for cryptographic chips. Figure 1 is a flow chart of a high spatial precision electromagnetic fault injection method for a cryptographic chip provided by an embodiment of the present invention, see Figure 1 , specifically including:

[0049] Step S01, prepare an electromagnetic fault injection experimental device, which specifically includes a host computer, an electromagnetic pulse generator, an electromagnetic probe, an XYZ direction three-axis displacement platform and a cryptographic chip to be tested; the host computer is used to control and operate various devices in the experimental platform, and use the serial port to achieve communication with the cryptographic chip to be tested, the pulse generator is used to generate an electromagnetic pulse signal, the electromagnetic probe is used to generate a high-voltage transient electromagnetic field, and then generate a transient induced voltage and current in the target chip, and the XYZ direction three-axis displacement platform is used to accurately adjust the relative position of the electromagnetic probe and the target chip.

[0050] Before the operation starts, the parameters of the electromagnetic fault injection device can be set, such as the pulse width and frequency of the electromagnetic pulse, the step speed of the mobile station, the moving step length, the fault injection time, etc.

[0051] Step S02, fixing the password chip to be tested on a three-axis displacement platform in the XYZ directions.

[0052] For smart card chips, the back of the smart card is usually facing up because the contact pads inside the smart card chip effectively shield a large part of the magnetic flux. For embedded chips, the front of the embedded chip is usually facing up because the electromagnetic field can easily pass through the external plastic package or epoxy resin package.

[0053] Step S1, determining a cryptographic chip to be tested; the optional target chip is, for example, a cryptographic chip, which can encrypt input plaintext into output ciphertext using an encryption algorithm.

[0054] Step S2, inputting plain text into the cryptographic chip to be tested, and obtaining a first ciphertext output by the cryptographic chip to be tested.

[0055] The first ciphertext is the correct ciphertext output when the cryptographic chip to be tested is not attacked in any way, and serves as a reference for subsequent verification of whether the target bit is reversed.

[0056] In cryptography, ciphertext is a series of bits obtained by converting plaintext into a series of bits by an encryption algorithm, and each bit can be 0 or 1. When a target bit is affected by a fault, its value may be reversed, that is, if the original value is 0, it may become 1 after the fault is injected; if the original value is 1, it may become 0 after the fault is injected. By analyzing the reversal of the target bit in multiple fault injection instances, the tester can infer some key information in the encryption process and eventually derive the encryption key.

[0057] Step S3: Select a target bit in the first ciphertext.

[0058] Step S4, determining the sensitive position data that can invert the value of the target bit, wherein the sensitive position data is the three-dimensional coordinates of the electromagnetic probe and the horizontal angle between the electromagnetic probe and the cryptographic chip to be tested.

[0059] In summary:

[0060] The method for confirming the X and Y coordinates in the three-dimensional coordinates of the electromagnetic probe is as follows: gridding the cryptographic chip to be tested, which can be a gridding operation setting for the SRAM area of ​​the chip to be evaluated, and a sensitivity map can be made to indicate the corresponding sensitive points when testing different bytes of the cryptographic chip. Repeatedly inject faults at every possible location on the chip. Draw a map based on the fault location and effect, and point out the sensitive point corresponding to the byte. Figure 2 As shown, the cryptographic chip to be tested can be divided into multiple grid areas in units of millimeters. The dots in the figure represent the plane positions of the sensitive points that are susceptible to electromagnetic pulse interference. The darker the color, the more susceptible it is to electromagnetic pulse interference.

[0061] According to the target byte of the test, the probe is placed at the most sensitive position of the target chip through the three-axis displacement platform in the XYZ direction to obtain (X, Y). Specifically, at each grid, take each bit in the ciphertext as the target and perform the following operations:

[0062] Step S41, assuming that the coordinates of the current grid are (X, Y), placing the electromagnetic probe at a height H above the grid, H>0, transmitting electromagnetic pulses to the password chip to be tested at the same angle, repeating the transmitting process several times, and counting the number of times the value of the target bit is reversed after each transmission;

[0063] Step S42, calculating the probability P1 of the target bit value being reversed according to the number of the reverses;

[0064] Step S43: If the probability P1 is greater than the preset value P 10 , the X and Y coordinate values ​​of the coordinates of the current grid are the X and Y coordinate values ​​of the sensitive position data of the target bit; otherwise, the next grid is operated from step S41 to step S42; until the X and Y coordinate values ​​of the sensitive position data corresponding to each bit in the ciphertext are determined.

[0065] The method for confirming the Z coordinate in the three-dimensional coordinates of the electromagnetic probe is as follows:

[0066] Step S44, at the X, Y coordinates of the sensitive position corresponding to the target bit, the distance between the electromagnetic probe and the password chip to be tested is adjusted, and the electromagnetic pulse transmission operation is performed several times at the same angle, and the number of times the value of the target bit is reversed after each transmission is counted; the electromagnetic probe moves relative to the password chip to be tested, and traverses the spatial position vertically above the (X, Y) coordinate in a manner from far to near;

[0067] The moving method can adopt the method of arithmetic progression, and a round of testing is performed every fixed distance.

[0068] Step S45, calculating the probability P2 of the target bit value being reversed according to the number of the reversed times;

[0069] Step S46: If the probability P2 is greater than the preset value P 20 , the Z value of the coordinates of the current grid is the Z coordinate value of the sensitive position data of the target bit; otherwise, steps S44 to S45 are performed on the next grid; until the Z coordinate value of the sensitive position data corresponding to each bit in the ciphertext is determined.

[0070] The angle between the electromagnetic probe and the password chip to be tested is confirmed by:

[0071] Step S47, at the X, Y, and Z coordinates corresponding to the target bit, adjust the angle between the electromagnetic probe and the cryptographic chip to be tested, perform several electromagnetic pulse emission operations, and count the number of times the value of the target bit is reversed after each emission; adjust the angle between the electromagnetic probe and the cryptographic chip to be tested to: take the (X, Y, Z) coordinate as the center of the sphere, and traverse the angles that can emit electromagnetic pulses to the cryptographic chip to be tested;

[0072] The moving method can adopt the method of arithmetic progression, and a round of testing is performed at every fixed angle.

[0073] Step S48, calculating the probability P3 of the target bit value being reversed according to the number of the reverses;

[0074] Step S49: If the probability P3 is greater than the preset value P 30 , then the current angle between the electromagnetic probe and the password chip to be tested is the angle value of the sensitive position data of the target bit; otherwise, step S47 to step S48 are performed on the next grid; until the angle value of the sensitive position data corresponding to each bit in the ciphertext is determined.

[0075] When the injected electromagnetic pulse causes the value of the target bit to reverse, it can be considered that the sensitive position of the target bit has been found. In order to improve the accuracy of the test, multiple test operations can also be selected. When the probability that the injected electromagnetic pulse causes the value of the target bit to reverse reaches a certain value, the sensitive position is considered to have been found.

[0076] During the differential fault analysis (DFA) process, as the sensitive position information of the cryptographic chip is gradually confirmed, the conditions for the target bit to be reversed become more favorable. This means that when the electromagnetic probe is adjusted to a position and angle closer to the optimal XYZ space, the probability of the target bit to be reversed (P1, P2, P3) will increase successively, reflecting the improvement of the fault injection efficiency. Accordingly, in order to identify the truly effective fault injection point, the threshold (P 10 , P 20 , P 30 ) will also increase accordingly, ensuring that the location is considered sensitive only when the fault injection achieves a high success rate. This strategy ensures that as the probe position and angle are continuously optimized, the precise location that can cause the target bit inversion can be more reliably identified, thereby improving the accuracy and efficiency of differential fault analysis.

[0077] From the principle analysis, step S4 can be understood as follows:

[0078] The angle θ1 between the coil surface and the magnetic field line and the distance Z1 from the center of the coil to the point on the axis are preliminarily determined by the stepwise approximation method. Assume that the reference pulse amplitude is V1, start from a longer distance, and gradually move the probe closer to the password chip to be tested, while monitoring the injection effect. When the target bit is observed to be reversed, it can be considered that a suitable distance Z1 has been found. At the same time, avoid direct contact between the probe and the target to avoid short circuit or other physical damage. The direction of the electromagnetic field has a significant impact on the effect of fault injection. Adjust the direction of the probe to find the optimal coupling angle θ1.

[0079] like Figure 3 As shown, let the number of coil turns be N, its surface area be S, let the current flowing through the coil be I1 when the pulse amplitude is V1, the magnetic field induction intensity generated by the coil be B1, and the angle between the coil surface and the magnetic field line be θ1, then the magnetic flux of the coil is φ B1 It is expressed as:

[0080] ;

[0081] Assume the magnetic permeability of the medium in the coil is μ r , the radius of the coil is r, the distance from the center of the coil to the point on the axis is Z1, then the magnetic induction intensity at the center of the coil can be expressed as:

[0082] ;

[0083] When the coil is close to the target chip, according to the law of electromagnetic induction, the induced electromotive force generated in the target chip can be expressed as:

[0084] ;

[0085] Substituting the above equation into the pulse amplitude V1, the induced electromotive force generated by the target chip is:

[0086] ;

[0087] For different injection intensities, the position of the electromagnetic probe is adjusted to precisely control the electromagnetic fault injection with high spatial accuracy. When the pulse amplitude is V2, the time rate of change of the current flowing through the coil becomes In order to control the induced electromotive force ε generated by the target chip and achieve accurate fault injection into the target byte, the angle θ1 between the coil surface and the magnetic field line and the distance Z1 from the center of the coil to the point on the axis need to be adjusted to θ2 and Z2 respectively. .

[0088] From the above, we can get the spatial position (X, Y, Z2) and angle θ2 of the electromagnetic probe. It can also be seen that by adjusting the spatial position of the electromagnetic probe, that is, the precise positioning of Z and the angle with the chip surface, the intensity of the induced electromotive force can be further changed, so that the electromagnetic fault injection can act more accurately on the key area of ​​the chip, thereby improving the pertinence and effectiveness of the fault injection.

[0089] Step S5, setting an electromagnetic probe according to the sensitive position data, emitting electromagnetic pulses to the cryptographic chip to be tested, obtaining the second ciphertext output by the cryptographic chip to be tested, and monitoring the value of the target bit;

[0090] Step S6: if the value of the target bit is reversed, proceed to step S7; if the value of the target bit is not reversed, return to step S4 to redetermine the sensitive position data;

[0091] Step S7, save the data vector, the data vector includes the first ciphertext, the second ciphertext, and change the input plaintext, select the next target bit, repeat steps S2 to S6, if every bit in the second ciphertext has been traversed, proceed to step S8.

[0092] When the target bit is reversed, a test cycle is completed, and the chip is initialized and the device is reset.

[0093] The purpose of replacing the plain text is to increase the diversity of data and improve the accuracy of differential analysis. You can determine whether to replace it according to your needs. At the same time, the replaced plain text can adopt a certain pattern, such as only one bit or some information is different, which can also reduce the amount of data for later analysis and improve efficiency.

[0094] It is worth emphasizing that, under normal circumstances, electromagnetic pulse interference will cause non-unique interference to the cryptographic chip, and its output result may not necessarily be what we want. In order to improve the accuracy of the later differential analysis and reduce the amount of calculated data, the present invention monitors the reversal of a single target bit. When non-single bit reversal or other interference occurs, it is recorded as ineffective interference. In other embodiments, other monitoring standards can also be selected.

[0095] Step S8, using a differential fault analysis algorithm to analyze the stored data vector to crack the key information of the cryptographic chip to be tested.

[0096] Specifically:

[0097] Step S81, obtaining a set of data vectors, including a first ciphertext and a second ciphertext;

[0098] Step S82, calculating the difference between the first ciphertext and the second ciphertext in each group of data vectors to obtain a candidate fault set;

[0099] Step S83, performing an intersection operation on the candidate fault set to obtain the key of the cryptographic chip to be tested.

[0100] As a mature technology, the differential fault analysis (DFA) algorithm has been widely used in the security analysis and key cracking of cryptographic chips. By deeply analyzing the ciphertext differences caused by minor faults introduced during the encryption process, DFA can effectively infer the encryption key. This technology utilizes the characteristic that the ciphertext changes significantly due to minor changes in the plaintext in the encryption algorithm, and gradually reveals the key information by comparing the output differences under faulty and normal execution conditions. Due to the wide application and in-depth research of the DFA algorithm in the field of cryptanalysis, its theoretical and practical methods are quite mature. Therefore, this invention will no longer explain it in detail, but will focus on how to enhance the effectiveness and accuracy of DFA through high spatial precision electromagnetic fault injection methods.

[0101] The effectiveness of the above method can be verified, that is, the accuracy of DFA can be verified by comparing the cracked key with the input key; the ratio of the effective fault injection times n to all fault injection times N is defined as the effective fault injection success rate ISR(f) of the cryptographic chip:

[0102] ;

[0103] The higher the ISR(f), the more effective the method is. Combining the effect of DFA and the success rate of effective fault injection, the electromagnetic fault injection method with high spatial accuracy is evaluated.

[0104] The present invention is aimed at the electromagnetic fault injection test of the cryptographic chip, and proposes a high spatial precision electromagnetic fault injection method for the cryptographic chip. The method can more accurately control the spatial position of the electromagnetic probe when the electromagnetic fault is injected into the cryptographic chip, improve the efficiency and effect of DFA analysis, and improve the success rate of effective injection. Considering the coupling mechanism between the probe that generates the electromagnetic pulse and the target circuit, the electromagnetic pulse fault has a local effect, and the spatial position of the electromagnetic probe is adjusted to find the sensitive point (X, Y) of the target byte. Different electromagnetic pulse intensities should also be considered to further adjust the spatial position of the electromagnetic probe. Multiple electromagnetic pulse fault injections are performed on the cryptographic chip, and the fault injection that successfully reverses the target bit is regarded as a valid injection. The erroneous ciphertext output by the same key under different input plaintexts is collected, and the key information of the cryptographic chip is cracked using differential fault analysis (DFA). Combined with the effect of DFA and the success rate of effective fault injection, the high spatial precision electromagnetic fault injection method is evaluated. This technology helps cryptographic chip designers to timely improve protective measures for electromagnetic fault injection and enhance the security of the chip.

[0105] Example 2

[0106] like Figure 4 As shown, the present invention also proposes a high spatial precision electromagnetic fault injection system for a cryptographic chip, using the high spatial precision electromagnetic fault injection method for a cryptographic chip as described in any one of Embodiment 1, including the following parts:

[0107] Host computer: used to control and operate each device in the experimental platform, and use the serial port to communicate with the cryptographic chip;

[0108] Electromagnetic pulse generator: connected to the host computer, used to generate electromagnetic pulse signals;

[0109] Electromagnetic probe: connected to the electromagnetic pulse generator and the password chip to be tested, used to generate a high-voltage transient electromagnetic field, thereby generating transient induced voltage and current in the password chip to be tested;

[0110] XYZ direction three-axis displacement platform: connected to the host computer, used to accurately adjust the relative position of the electromagnetic probe and the target chip. The step speed and moving step length of the XYZ direction three-axis displacement platform are set according to the size of the password chip to be tested. The larger the size of the password chip to be tested, the slower the step speed of the XYZ direction three-axis displacement platform and the smaller the moving step length.

[0111] Example 3

[0112] A computer-readable storage medium, comprising computer program instructions, wherein the computer program instructions enable a computer to execute the steps of a high spatial precision electromagnetic fault injection method for a cryptographic chip as described in any one of Embodiment 1.

[0113] The computer readable storage medium can adopt any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium can include, for example, but is not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0114] It should be noted that the terms used in the present invention are only for describing specific embodiments, rather than limiting the scope of the present application. As shown in the present specification, unless the context clearly indicates an exception, the words "one", "a", "a kind of" and / or "the" do not specifically refer to the singular, but may also include the plural. The terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method or device. In the absence of more restrictions, the elements defined by the sentence "include one..." do not exclude the presence of other identical elements in the process, method or device including the elements.

[0115] It should also be noted that the terms "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention. Unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", etc. should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be a connection between the two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0116] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the technical solutions of the embodiments of the present invention.

Claims

1. A high spatial precision electromagnetic fault injection method for cryptographic chips, used for cryptographic chip security testing, characterized in that: The steps include: Inputting plain text into the cryptographic chip to be tested, and obtaining a first ciphertext output by the cryptographic chip to be tested; Select a target bit in the first ciphertext; Determine sensitive position data that can invert the value of the target bit, wherein the sensitive position data is the three-dimensional coordinates of the electromagnetic probe and the horizontal angle between the electromagnetic probe and the cryptographic chip to be tested; An electromagnetic probe is set according to the sensitive position data, an electromagnetic pulse is emitted to the cryptographic chip to be tested, a second ciphertext output by the cryptographic chip to be tested is obtained, and a value of the target bit is monitored; If the value of the target bit is reversed, proceed to the next step; if the value of the target bit is not reversed, re-determine the sensitive position data; Save the data vector, which includes the first ciphertext and the second ciphertext, change the input plaintext, select the next target bit, repeat all the above operations, and proceed to the next step if every bit in the second ciphertext has been traversed; The differential fault analysis algorithm is used to analyze the saved data vector, crack the key information of the cryptographic chip to be tested, and complete the security test of the cryptographic chip.

2. A high spatial precision electromagnetic fault injection method for a cryptographic chip according to claim 1, characterized in that: Before inputting the plain text into the cryptographic chip to be tested and obtaining the first ciphertext output by the cryptographic chip to be tested, the method further includes: Prepare an electromagnetic fault injection experimental device, which specifically includes a host computer, an electromagnetic pulse generator, an electromagnetic probe, an XYZ direction three-axis displacement platform and a password chip to be tested; the host computer is used to control and operate various devices in the experimental platform, and use a serial port to achieve communication with the password chip to be tested, the pulse generator is used to generate an electromagnetic pulse signal, the electromagnetic probe is used to generate a high-voltage transient electromagnetic field, and the XYZ direction three-axis displacement platform is used to accurately adjust the relative position of the electromagnetic probe and the password chip to be tested; Fix the password chip to be tested on the three-axis displacement platform in the XYZ direction.

3. A high spatial precision electromagnetic fault injection method for a cryptographic chip according to claim 2, characterized in that: The method for confirming the X and Y coordinates in the three-dimensional coordinates of the electromagnetic probe is as follows: the cryptographic chip to be tested is divided into a grid, and at each grid, each bit in the ciphertext is taken as the target, and the following operations are performed: Assume that the coordinates of the current grid are (X, Y), place the electromagnetic probe at a height H above the grid, H>0, and emit electromagnetic pulses to the password chip to be tested at the same angle. Repeat the emission process several times, and count the number of times the value of the target bit is reversed after each emission; Calculate the probability P1 of the target bit value being reversed according to the number of reversals; If the probability P1 is greater than the preset value P 10 , the X and Y values ​​of the coordinates of the current grid are the X and Y coordinate values ​​of the sensitive position data of the target bit; otherwise, the first two steps are performed on the next grid; until the X and Y coordinate values ​​of the sensitive position data corresponding to each bit in the ciphertext are determined.

4. A high spatial precision electromagnetic fault injection method for a cryptographic chip according to claim 3, characterized in that: The method for confirming the Z coordinate in the three-dimensional coordinates of the electromagnetic probe is as follows: At the X and Y coordinates of the sensitive position corresponding to the target bit, the distance between the electromagnetic probe and the password chip to be tested is adjusted, and the electromagnetic pulse transmission operation is performed several times at the same angle, and the number of times the value of the target bit is reversed after each transmission is counted; Calculate the probability P2 of the target bit value being reversed according to the number of reversals; If the probability P2 is greater than the preset value P 20 , the Z value of the coordinate of the current grid is the Z coordinate value of the sensitive position data of the target bit; otherwise, the first two steps are performed on the next grid; until the Z coordinate value of the sensitive position data corresponding to each bit in the ciphertext is determined.

5. A high spatial precision electromagnetic fault injection method for a cryptographic chip according to claim 4, characterized in that: The angle between the electromagnetic probe and the password chip to be tested is confirmed by: At the X, Y, and Z coordinates corresponding to the target bit, the angle between the electromagnetic probe and the cryptographic chip to be tested is adjusted, and the electromagnetic pulse transmission operation is performed several times, and the number of times the value of the target bit is reversed after each transmission is counted; Calculate the probability P3 of the target bit value being reversed according to the number of reversals; If the probability P3 is greater than the preset value P 30 , then the current angle between the electromagnetic probe and the cryptographic chip to be tested is the angle value of the sensitive position data of the target bit; otherwise, perform the first two steps on the next grid; until the angle value of the sensitive position data corresponding to each bit in the ciphertext is determined.

6. A high spatial precision electromagnetic fault injection method for a cryptographic chip according to claim 5, characterized in that: P1 <P2<P3,P 10 <P 20 <P 30 。 7. A high spatial precision electromagnetic fault injection method for a cryptographic chip according to claim 4, characterized in that: The distance between the electromagnetic probe and the password chip to be tested is adjusted as follows: the electromagnetic probe moves relative to the password chip to be tested, traversing the spatial position vertically above the (X, Y) coordinate in a manner from far to near.

8. The high spatial precision electromagnetic fault injection method for a cryptographic chip according to claim 5, characterized in that: The angle between the electromagnetic probe and the password chip to be tested is adjusted to: with the (X, Y, Z) coordinate as the center of the sphere, traverse the angle at which the electromagnetic pulse can be emitted to the password chip to be tested.

9. A high spatial precision electromagnetic fault injection method for a cryptographic chip according to claim 1, characterized in that: The differential fault analysis algorithm is used to analyze the saved data vector and crack the key information of the cryptographic chip to be tested, specifically: Obtain a set of data vectors, including a first ciphertext and a second ciphertext; Calculate the difference between the first ciphertext and the second ciphertext in each set of data vectors to obtain a candidate fault set; An intersection operation is performed on the candidate fault set to obtain the key of the cryptographic chip to be tested.

Images