Password side channel analysis method based on supervised comparative learning
By using the supervised contrastive learning method in the neural network to extract and utilize the category information of energy waveforms, it solves the problem that the neural network is difficult to extract similarity information between similar energy waveforms associated with key-related intermediate variables, and improves side performance. Performance of channel analysis methods.
Patent Information
- Application Number
- CN202411198930.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-29
- Publication Date
- 2025-01-14
AI Technical Summary
It is difficult for neural networks to extract similarity information between similar energy waveforms associated with key-related intermediate variables, resulting in waste of effective information.
Using a method based on supervised contrastive learning, plaintext and keys are randomly selected to perform cryptographic operations on controllable devices, the energy waveforms are collected, and the modeling waveforms are intercepted by identifying the areas of intermediate variables related to the keys, and each waveform corresponds to Key-related intermediate variables are used as labels to construct modeling data sets, train neural network models, and use supervised contrastive loss functions to optimize the training process.
It can more efficiently utilize the category information of energy waveforms, extract similarity information between similar energy waveforms associated with key-related intermediate variable information, improve the performance of side channel analysis methods based on neural networks, and reduce the difficulty of cryptanalysis.
Smart Images
Figure CN119316125A_ABST
Abstract
Description
Technical Field
[0001] The invention relates to a cryptographic side channel analysis method based on supervised contrastive learning, belongs to the technical field of information security, and is applied to cryptographic side channel analysis. Background Art
[0002] The widespread use of IoT technology has aroused great concern about the security of smart devices. Side channel analysis technology, as a means of physical security analysis, is one of the security threats faced by IoT security devices. IoT smart devices may inadvertently leak physical information, such as power consumption, electromagnetic radiation, and time deviation when executing cryptographic algorithms. Side channel analysis uses this physical information to recover the key of the cryptographic algorithm. Modeling side channel analysis is considered to be one of the most threatening side channel analysis techniques. In the modeling side channel analysis scenario, neural network-based side channel analysis technology has become one of the most powerful side channel analysis methods with its high accuracy, no need for waveform preprocessing, strong scalability, and automatic feature extraction.
[0003] In the neural network-based side channel analysis scenario, it is difficult for the neural network to extract the similarities between similar energy waveforms associated with key-related intermediate variables, which often leads to the waste of effective information.
[0004] To solve the above problems, supervised contrastive learning allows the network to regard energy waveforms of the same category as positive samples and energy waveforms of different categories as negative samples, and extract the similarities between energy waveforms of the same category related to key-related intermediate variables, so as to more efficiently utilize the category information of energy waveforms, and make energy waveforms of the same category more similar after being encoded by the neural network, and energy waveforms of different categories more different after being encoded by the neural network, thereby improving the performance of the side channel analysis method based on neural networks. Summary of the invention
[0005] The purpose of the present invention is to solve the technical problem that it is difficult for a neural network to extract similarity information between similar energy waveforms associated with key-related intermediate variables, and proposes a cryptographic side channel analysis method based on supervised contrastive learning.
[0006] The objective of the present invention is achieved through the following technical solutions:
[0007] The present invention is a cryptographic side channel analysis method based on supervised contrastive learning, which is applied to a target device to be analyzed and a controllable device with write key permission that is the same as the cryptographic device, and comprises the following steps:
[0008] Step 1: Randomly select plaintext and key to perform cryptographic operations on controllable devices and collect corresponding energy waveforms. Identify the area corresponding to the key-related intermediate variables in the energy waveform as the analysis position, intercept the position to obtain the modeling waveform, and use the key-related intermediate variables corresponding to each waveform as labels to construct the modeling data set with the modeling waveform and labels.
[0009] Step 1.1: Preset random plaintext and key, perform cryptographic operations on the random plaintext on a controllable device, and collect energy waveforms during the cryptographic operation.
[0010] Step 1.2: Identify the region corresponding to the key-related intermediate variable in the energy waveform as the analysis position, and intercept the position to obtain the modeling waveform.
[0011] Step 1.3: Use the key-related intermediate variables corresponding to each modeling waveform as labels, and construct a modeling dataset using the modeling waveform and the labels.
[0012] Step 2: Preset random plaintext, use the target device to perform cryptographic operations on the random plaintext, collect the corresponding energy waveform, use the analysis position in step 1, intercept the waveform to obtain the analysis energy waveform, and save the plaintext corresponding to each waveform. The analysis energy waveform and plaintext are used together to construct the analysis data set.
[0013] Step 3: Build a neural network model and train the neural network using the modeling dataset.
[0014] Step 3.1: Build a neural network model and set hyperparameters for the network.
[0015] Step 3.2: Train the neural network using the modeling dataset.
[0016] Step 3.3: Use the supervised contrast loss function as shown in formula (1) to optimize the neural network training process.
[0017]
[0018] The supervised contrast loss function takes a set of energy waveform key-related intermediate variable guessing probability p, representation z and its corresponding label as input, where z is the output of the second-to-last layer of the neural network, p is the probability value corresponding to each key-related intermediate variable value predicted by the neural network, ||·|| represents l2 regularization, and the cosine similarity of two vectors α and β is defined as shown in formula (2). K represents the total number of neural network classifications, c is the guessed category of sample i, and the probability p of the neural network predicting that sample i belongs to category c is ic ,y ic is a sign function, which takes 1 when the true category of sample i is equal to the guessed category c, otherwise it takes 0. irepresents the representation of each energy waveform in the feature space of the neural network output, N represents the size of a batch, P(i) represents the index set of the i-th waveform in the same batch that is not the i-th waveform but is a positive sample of the i-th waveform. is an indicator function, which takes the value 1 if and only if k≠i, otherwise it takes the value 0. τ represents a settable temperature parameter. For the characterization z of the i-th waveform in the same batch i , use formula (3) to calculate all the corresponding positive sample pairs in the batch (z i ,z j ), and use formula (4) to calculate the similarity of z except itself. i Compared with all other samples (z i ,z k ) and the similarity of .
[0019] Step 4: Iterate steps 3.2 and 3.3 until the neural network reaches fitting, and obtain the trained neural network.
[0020] Step 5: Input the analysis data set constructed in step 2 into the trained neural network to obtain the probability value of each energy waveform corresponding to each key-related intermediate variable. By combining the plaintext corresponding to each energy waveform and the specific cryptographic algorithm, the guessed key corresponding to each key-related intermediate variable under each energy waveform is calculated, and the probability of each energy waveform corresponding to each guessed key is obtained. For each guessed key value, calculate the product of the probabilities of all energy waveforms corresponding to the guessed key. The guessed key with the largest probability product is taken as the actual key.
[0021] Step 5.1: Input the energy waveform collected in step 2 into the trained neural network to obtain the probability value of each energy waveform corresponding to each key-related intermediate variable.
[0022] Step 5.2: Combine the plaintext corresponding to each energy waveform and the specific cryptographic algorithm to obtain the mapping relationship between the key-related intermediate variables and the key of each energy waveform. Using the mapping relationship between the key-related intermediate variables and the key of each energy waveform, the probability value of each energy waveform corresponding to each key-related intermediate variable is converted into the probability value of each energy waveform corresponding to each guessed key.
[0023] Step 5.3: Calculate the product of the probability values of guessed keys corresponding to all energy waveforms, and take the energy waveform with the largest product of the probability values of guessed keys as the actual key.
[0024] Beneficial effects:
[0025] Compared with the prior art, the present invention has the following effects:
[0026] The method of the present invention can extract similarity information between similar energy waveforms associated with key-related intermediate variable information, use fewer energy waveforms to recover the actual key, and have a higher accuracy in recovering the key. It can efficiently use the effective information of the energy waveform, further improve the performance of the side channel analysis method based on the neural network, and reduce the difficulty of cryptanalysis. BRIEF DESCRIPTION OF THE DRAWINGS
[0027] Figure 1 is a flow chart of the method of the present invention;
[0028] Figure 2 It is a graph of the estimated entropy of the present invention experimented on the ASCAD database;
[0029] Figure 3 It is a comparison chart of the effects of the present invention and the convolutional neural network on the ASCAD database. DETAILED DESCRIPTION
[0030] In order to better illustrate the purpose and advantages of the present invention, the invention is further described below in conjunction with the accompanying drawings and examples. It should be noted that the implementation of the present invention is not limited to the following embodiments, and any form of modification or change made to the present invention will fall within the protection scope of the present invention.
[0031] The present invention adopts an 8-bit AVR development board of a cryptographic device as a hardware device for implementation, and selects a device to be analyzed as a target device, so as to obtain the energy waveform to be analyzed when the device to be analyzed runs a protected AES cryptographic algorithm; a device with write key permission and the same as the target device is selected as a controllable device, which is used to run the protected AES cryptographic algorithm and collect the energy waveform during the operation of the cryptographic algorithm of the device; this embodiment takes the protected AES algorithm as an example, and uses the PyTorch library in Python to conduct experiments; the following embodiments are specifically adopted for implementation.
[0032] Example
[0033] like Figure 1 As shown, a password side channel analysis method based on supervised contrastive learning of the present invention is specifically implemented in the following steps:
[0034] Step 1: Randomly select plaintext to perform cryptographic operations on a controllable device and collect the corresponding energy waveform. Identify the area corresponding to the key-related intermediate variable in the energy waveform as the analysis position, intercept the position to obtain the modeling waveform, and use the plaintext, key, and key-related intermediate variable corresponding to each waveform as a label pair. The modeling waveform and label pair jointly construct the modeling data set.
[0035] Step 1.1: Preset a random plaintext, perform cryptographic operations on the random plaintext on a controllable device, and collect energy waveforms during the cryptographic operation.
[0036] Step 1.2: Identify the region corresponding to the key-related intermediate variable in the energy waveform as the analysis position, and intercept the position to obtain the modeling waveform.
[0037] Step 1.3: The plaintext, key, and key-related intermediate variables corresponding to each modeling waveform are used as label pairs, and the modeling waveform and label pairs are used to construct a modeling dataset.
[0038] In the embodiment, this example is experimented on the public ASCAD data set, which collects the energy waveforms corresponding to the protected AES cryptographic algorithm implemented by Benadjila et al. on the 8-bit AVR development board, saves the plaintext and key corresponding to each energy waveform, and uses the S-box output of the third byte of the first round as the label. This example uses the modeling data set provided by the ASCAD data set, which contains 50,000 energy waveforms and corresponding labels.
[0039] Step 2: Preset random plaintext, use the target device to perform cryptographic operations on the random plaintext, collect the corresponding energy waveform, use the analysis position in step 1, intercept the waveform to obtain the analysis energy waveform, and save the plaintext corresponding to each waveform. The analysis energy waveform and plaintext are used together to construct the analysis data set.
[0040] In the embodiment, this example uses an analysis data set provided by ASCAD, and the analysis data set includes 10,000 energy waveforms and corresponding plain texts.
[0041] Step 3: Build a neural network model and train the neural network using the modeling dataset.
[0042] Step 3.1: Build a neural network model and set hyperparameters for the network.
[0043] Step 3.2: Train the neural network using the modeling dataset.
[0044] Step 3.3: Use the supervised contrast loss function as shown in formula (1) to optimize the neural network training process.
[0045]
[0046] The supervised contrast loss function takes as input the probability p of guessing the key-related intermediate variables of a set of energy waveforms, the representation z and its corresponding label, where z is the output of the second-to-last layer of the neural network, p is the probability value corresponding to each key-related intermediate variable predicted by the neural network, ||·|| represents l2 regularization, and the cosine similarity of the two vectors α and β is defined as shown in formula (2). K represents the total number of categories corresponding to the energy waveform, c is the guessed category of sample i, and the probability p of the neural network predicting that sample i belongs to category c is ic ,yic is a sign function, which takes 1 when the true category of sample i is equal to the guessed category c, otherwise it takes 0. i represents the representation of each energy waveform in the feature space of the neural network output, N represents the size of a batch, P(i) represents the index set of the i-th waveform in the same batch that is not the i-th waveform but is a positive sample of the i-th waveform. is an indicator function, which takes the value 1 if and only if k≠i, otherwise it takes the value 0. τ represents a settable temperature parameter. For the characterization z of the i-th waveform in the same batch i , use formula (3) to calculate all the corresponding positive sample pairs in the batch (z i ,z j ), and use formula (4) to calculate the similarity of z except itself. i Compared with all other samples (z i ,z k ) and the similarity of .
[0047] In the embodiment, a neural network consisting of multiple convolutional blocks and fully connected layers is constructed. The specific neural network structure is shown in Table 1. The encoding length of the final output of the neural network is set to 256 dimensions, that is, the guessing probability p corresponding to 256 S-box output values is ic In this example, the batch size is set to 1000 and the learning rate is set to 10 -5 , the number of training cycles is set to 200, and the optimizer is set to RMSProp. The total number K of energy waveforms corresponding to the categories in formula (1) is 256, and the temperature parameter τ is set to 0.07.
[0048] Table 1 Neural network structure
[0049]
[0050] Step 4: Iterate steps 3.2 and 3.3 until the neural network reaches fitting, and obtain the trained neural network.
[0051] Step 5: Input the analysis data set constructed in step 2 into the trained neural network to obtain the probability value of each energy waveform corresponding to each key-related intermediate variable. By combining the plaintext corresponding to each energy waveform and the specific cryptographic algorithm, the guessed key corresponding to each key-related intermediate variable under each energy waveform is calculated, and the probability of each energy waveform corresponding to each guessed key is obtained. For each guessed key value, calculate the product of the probabilities of all energy waveforms corresponding to the guessed key. The guessed key with the largest probability product is taken as the actual key.
[0052] Step 5.1: Input the energy waveform collected in step 2 into the trained neural network to obtain the probability value of each energy waveform corresponding to each key-related intermediate variable.
[0053] Step 5.2: Combine the plaintext corresponding to each energy waveform and the specific cryptographic algorithm to obtain the mapping relationship between the key-related intermediate variables and the key of each energy waveform. Using the mapping relationship between the key-related intermediate variables and the key of each energy waveform, the probability value of each energy waveform corresponding to each key-related intermediate variable is converted into the probability value of each energy waveform corresponding to each guessed key.
[0054] Step 5.3: Calculate the product of the probability values of guessed keys corresponding to all energy waveforms, and take the energy waveform with the largest product of the probability values of guessed keys as the actual key.
[0055] In the embodiment, the energy waveform in the analysis data set in step 2 is input into the trained neural network, and the probability value of each energy waveform corresponding to each S-box output value is obtained. The S-box output value is mapped back to the result of the original plaintext XOR key using an inverse S-box, and then the result is XORed with the plaintext byte again to obtain the guessed key corresponding to each S-box output value, and thus the probability of each energy waveform corresponding to each guessed key is obtained. For each guessed key value, the product of the probabilities of all energy waveforms corresponding to the guessed key is calculated. Finally, the guessed key with the largest probability product is considered to be the actual key.
[0056] In order to further demonstrate the superiority of the password side channel analysis method based on supervised contrastive learning over the side channel analysis method based on convolutional neural network, experiments were conducted on the ASCAD database using guessing entropy as the evaluation indicator and compared with the convolutional neural network under the same hyperparameters.
[0057] The number of training cycles is fixed to 190 to achieve the best performance. In order to obtain reliable results, the guessing entropy values of the password side channel analysis method based on supervised contrastive learning are calculated when using different numbers of analysis energy waveforms to obtain the curve of the guessing entropy changing with the number of analysis energy waveforms.
[0058] Figure 2 The blue curve in the middle represents the change of guessed entropy with the number of analyzed energy waveforms. As the number of waveforms increases, the guessed entropy gradually decreases until it reaches 0, indicating that the cryptographic side channel analysis method based on supervised contrastive learning can recover the real key.
[0059] like Figure 3As shown in the figure, when the password side channel analysis method based on supervised contrastive learning uses 547 energy waveforms, the guessed entropy is equal to 0, that is, the password side channel analysis method based on supervised contrastive learning successfully recovers the correct key. The convolutional neural network method requires at least 1190 energy waveforms to successfully recover the correct key. It can be concluded that the password side channel analysis method based on supervised contrastive learning is significantly better than the side channel analysis method based on convolutional neural network.
[0060] The specific description above further illustrates the purpose, technical solutions and beneficial effects of the invention in detail. It should be understood that the above is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.
Claims
1. A cryptographic side channel analysis method based on supervised contrastive learning, characterized in that: The following steps are included: Step 1: Randomly select plaintext and key to perform cryptographic operations on the controllable device and collect the corresponding energy waveform; Identify the area corresponding to the key-related intermediate variable in the energy waveform as the analysis position, intercept the position to obtain the modeling waveform, and use the key-related intermediate variable corresponding to each waveform as a label, and construct a modeling data set with the modeling waveform and the label; Step 2: Preset random plaintext, use the target device to perform cryptographic operations on the random plaintext, collect the corresponding energy waveform, use the analysis position in step 1, intercept the waveform to obtain the analysis energy waveform, and save the plaintext corresponding to each waveform, and construct the analysis data set together with the analysis energy waveform and the plaintext; Step 3: Build a neural network model and train the neural network using the modeling data set; Step 3.1: Build a neural network model and set hyperparameters for the network; Step 3.2: Train the neural network using the modeling dataset; Step 3.3: Use the supervised contrast loss function as shown in formula (1) to optimize the neural network training process; The supervised contrast loss function takes a set of key-related intermediate variable guessing probability p of energy waveforms, representation z and its corresponding label as input, where z is the output of the penultimate layer of the neural network, p is the probability value corresponding to each key-related intermediate variable value predicted by the neural network, ∥·∥ represents l2 regularization, and the cosine similarity of two vectors α and β is defined as shown in formula (2); K represents the total number of neural network classifications, c is the guessed category of sample i, and the probability p of the neural network predicting that sample i belongs to category c ic ,y ic is a sign function, which takes 1 when the true category of sample i is equal to the guessed category c, otherwise it takes 0. i represents the representation of each energy waveform in the feature space of the neural network output, N represents the size of a batch, P(i) represents the index set of the i-th waveform in the same batch that is not the i-th waveform but is a positive sample of the i-th waveform. is an indicator function, which takes the value of 1 if and only if k≠i, otherwise it is 0; τ represents a settable temperature parameter; for the characterization of the i-th waveform in the same batch, z i , use formula (3) to calculate all the corresponding positive sample pairs in the batch (z i ,z j ), and use formula (4) to calculate the similarity of z except itself. i Compared with all other samples (z i ,z k )’s similarity and; Step 4: Iterate steps 3.2 and 3.3 until the neural network reaches the fitting state, and obtain the trained neural network; Step 5: Input the analysis data set constructed in step 2 into the trained neural network to obtain the probability value of each energy waveform corresponding to each key-related intermediate variable; calculate the guessed key corresponding to each key-related intermediate variable under each energy waveform by combining the plaintext corresponding to each energy waveform and the specific cryptographic algorithm, and thereby obtain the probability of each energy waveform corresponding to each guessed key; for each guessed key value, calculate the product of the probabilities of all energy waveforms corresponding to the guessed key; The guessed key with the largest probability product is taken as the actual key.
2. A cryptographic side channel analysis method based on supervised contrastive learning as claimed in claim 1, characterized in that: Step 1 is implemented as follows: Step 1.1: Preset random plaintext and key, perform cryptographic operation on the random plaintext on the controllable device, and collect energy waveform during the cryptographic operation; Step 1.2: Identify the region corresponding to the key-related intermediate variable in the energy waveform as the analysis position, and intercept the position to obtain the modeling waveform; Step 1.3: Use the key-related intermediate variables corresponding to each modeling waveform as labels, and construct a modeling dataset using the modeling waveform and the labels.
3. A cryptographic side channel analysis method based on supervised contrastive learning as claimed in claim 1, characterized in that: Step 5 is implemented as follows: Step 5.1: Input the energy waveform collected in step 2 into the trained neural network to obtain the probability value of each energy waveform corresponding to each key-related intermediate variable; Step 5.2: Combine the plaintext corresponding to each energy waveform and the specific cryptographic algorithm to obtain the mapping relationship between the key-related intermediate variables and the key of each energy waveform; use the mapping relationship between the key-related intermediate variables and the key of each energy waveform to convert the probability value of each energy waveform corresponding to each key-related intermediate variable into the probability value of each energy waveform corresponding to each guessed key; Step 5.3: Calculate the product of the probability values of guessed keys corresponding to all energy waveforms, and take the energy waveform with the largest product of the probability values of guessed keys as the actual key.