AES cryptographic chip leakage detection method combining power consumption and electromagnetic signal

Abstract

The invention relates to the field of image generation material mapping, and discloses a power consumption and electromagnetic signal combined AES cipher chip leakage detection method, which comprises the following steps: S1, a signal expansion module, S2, a signal fusion module, and S3, a leakage detection module. According to the method, the purpose of increasing signals is achieved by generating new power consumption or electromagnetic signals through the diffusion model, and the signal-to-noise ratio is improved through signal decomposition and fusion, so that the method still has better detection performance on the premise of smaller sample data, for example, for an AES algorithm implemented on an MCU, the detection efficiency is greatly improved. According to the technology, leakage points can be detected only by more than 3000 samples, however, the leakage points can be detected only by more than 10000 samples in an existing method, the measurement complexity is reduced, and more leakage feature points which cannot be found only through single-channel leakage detection are found by combining data of multiple signal sources and utilizing complementary information of the data.

Description

Technical Field

[0001] The present invention relates to the field of information security, in particular to AES cryptographic chip leakage detection in side channel attack detection and defense. Background Art

[0002] In the field of information security, it has always been important and necessary to evaluate the physical security of cryptographic chips through side channel analysis, and it has been included in many domestic and international security evaluation standards. For this reason, AES cryptographic chips need to undergo side channel analysis and security evaluation tests before entering the market. However, the actual testing process is usually costly and time-consuming, and requires processing data up to TB level in size - this places extremely high demands on the evaluator's signal acquisition, data storage and analysis and computing capabilities, and even seriously affects the efficiency of side channel analysis and security evaluation. For this reason, side channel leakage detection technology has been proposed to identify and select leakage feature points in the leakage signal that contain secret information or key information before conducting side channel analysis and security evaluation, thereby reducing the complexity of the leakage signal data and eliminating the interference of non-leakage points unrelated to the key on subsequent security analysis or evaluation.

[0003] The existing leakage detection technology usually assumes that the leakage feature points and non-leakage points in the leakage signal of the cryptographic chip come from different distribution populations. Therefore, a statistic is designed and a confidence level is preset. Then, a hypothesis test is performed on each sample point in the leakage signal. In this way, whether the sample point belongs to a leakage feature point is judged by whether the original hypothesis is accepted.

[0004] There are three main problems with the existing technology:

[0005] First, in order to obtain meaningful detection results, existing technologies all require the number of leakage signals to be comparable to or even higher than that of SCA. This is because even in the signals corresponding to the leakage feature points, the signals related to the secret information are still "small signals" (that is, in the collected leakage signals, electronic noise and algorithm noise account for the majority), resulting in hypothesis testing requiring more data to make effective judgments, which creates a huge contradiction with the purpose of leakage detection: leakage detection is originally used to reduce the complexity of signal data, but in fact these methods not only fail to reduce the complexity of data, but even put the cart before the horse, and greatly increase the measurement complexity and data complexity.

[0006] Second, the existing methods are very dependent on the correct estimation of the distribution of leaked data, which leads to a high level of Type I and Type II errors in hypothesis testing. That is, the probability of "taking false positives" (false positives) and "discarding true positives" (missed positive positives) at leak points is high, which will have a negative impact on the next step of side channel analysis and security assessment. In addition, when the data components are more complex, the probability of Type I and Type II errors in existing methods will also increase.

[0007] Third, the existing methods usually use power consumption data or electromagnetic data for analysis separately, lacking the effective combination of the two information, resulting in some hidden secret information not being fully revealed, and unable to fully reveal the internal state of the cryptographic chip. Even if there are individual methods such as W. Yang, H. Zhang, Y. Gao et al., "Side-channel leakage detection based on constant parameter channel model", in Proc. ICCD 2020, Hartford, CT, USA, Oct. 2020, pp. 553-560 and W. Yang, Anni Jia, "Side-channel leakage detection with one-way analysis of variance", Security and Communication Networks, vol. 2021, pp. 1-13, Mar. 2021, which attempt to perform channel fusion, they only concatenate power consumption data and electromagnetic data, resulting in low stability. Summary of the invention

[0008] Based on the measurement of small sample side channel signals, the present invention proposes an AES cryptographic chip leakage detection method that combines power consumption data and electromagnetic data information. By organically combining data preprocessing, machine learning, information fusion, multi-factor variance analysis and parameter consistency verification technology, the measurement complexity and data complexity in the side channel analysis are reduced, and the efficiency, accuracy and robustness of AES cryptographic chip leakage detection are effectively improved, so as to realize subsequent efficient side channel security analysis of AES cryptographic chips. By achieving the above purpose, the present invention can effectively make up for the deficiencies of the prior art, provide an efficient, accurate and reliable AES cryptographic chip leakage detection method, and has broad application prospects in the field of information security.

[0009] The present invention provides a method for AES cryptographic chip leakage detection by combining power consumption data and electromagnetic data, which improves the efficiency, accuracy and robustness of leakage detection by organically combining data preprocessing, machine learning, information fusion, multi-factor variance analysis and parameter consistency test technology. The specific technical solution mainly includes three modules: signal expansion module, signal fusion module, and leakage detection module. Each module includes two or one implementation steps.

[0010] The functions of the three modules are as follows: the signal expansion module is mainly used to increase the number of signals when the data samples are insufficient, so as to provide sufficient data for the use of statistical techniques in subsequent leakage detection; the signal fusion module is mainly used to simultaneously utilize the power consumption and electromagnetic two-channel signal information to mine the implicit joint secret information that cannot be revealed by single-channel leakage detection; the leakage detection module aims to effectively and accurately detect the leakage feature points of the cryptographic chip, laying the foundation for further security analysis.

[0011] To achieve the above object, the present invention provides the following technical solution: a method for detecting leakage of an AES cryptographic chip by combining power consumption and electromagnetic signals, the method comprising the following steps:

[0012] S1, signal expansion module

[0013] This module mainly includes two steps: data preprocessing and data generation (generated using the diffusion model).

[0014] (1) Data preprocessing

[0015] Data preprocessing mainly uses data standardization, noise reduction and dimensionality reduction. Among them, the data standardization step aims to eliminate the influence of the signal reference voltage and make the signal variation amplitude within the same range; noise reduction is to reduce the adverse effects of noise; dimensionality reduction is to further improve the signal quality, highlight the "small signals" related to secret information, and reduce data complexity to a certain extent.

[0016] (2) Data Generation

[0017] The data generation module mainly uses the diffusion model to generate new power consumption or electromagnetic data of similar quality based on the collected power consumption or electromagnetic signals, so as to achieve the purpose of increasing the number of samples and the capacity of secret information without increasing the measurement complexity, which is conducive to statistical analysis and can better extract the secret information in the "small signal".

[0018] The present invention generates new data using an improved diffusion model, which is a diffusion model based on the Kolmogorov-Arnold network (abbreviated as KAN), that is, KAN is applied to the denoising U-net network in the diffusion model (so the model is abbreviated as DU-KAN here). It can be seen from the overall architecture of DU-KAN that it belongs to a two-stage encoder-decoder architecture, including a convolution stage and a tokenized KAN stage. The input power consumption or electromagnetic signal passes through the encoder, wherein the first three blocks utilize convolution operations, followed by two tokenized KAN blocks, and the decoder also contains two tokenized KAN blocks, followed by three convolution blocks, each encoder block halves the feature resolution, and each decoder block doubles it. In addition, a jump connection is integrated between the encoder and the decoder, and the tokenized KAN block injects a learnable time embedding to improve the network's time perception ability and enhance the effectiveness of generating time series. The number of channels of each block in the convolution stage and the tokenized KAN stage is determined by its hyperparameters respectively;

[0019] S2, signal fusion module

[0020] This module mainly includes two steps: signal decomposition (using variational model decomposition technology) and data fusion.

[0021] (1) Signal decomposition

[0022] This step uses the variational mode decomposition (VMD) technology to adaptively achieve the frequency domain decomposition and effective separation of each component in the power consumption or electromagnetic signal by solving the frequency domain variational optimization problem. This method effectively separates the useful signal and noise in the power consumption or electromagnetic signal through iterative search, thereby achieving the purpose of improving the signal-to-noise ratio and enhancing the efficiency of leakage detection. In the present invention, the partial signal components containing secret information obtained by VMD decomposition are extracted for the next step of data fusion.

[0023] (2) Data Fusion

[0024] This step fuses the signal components extracted from the power consumption and electromagnetic channels in the previous steps, in order to simultaneously utilize the signal characteristics of different channels to extract more leakage information. The data fusion method adopted in this step belongs to the feature fusion method, that is, the singular value decomposition technology is used to obtain the left singular vector of the power consumption signal or the electromagnetic signal, and according to the principle of minimum total variation, the feature vector containing the secret information is extracted to form a feature vector set, and then the feature vectors of the two channels are recombined into a new fused signal set;

[0025] S3. Leakage detection module

[0026] This module mainly combines multi-factor variance analysis and parameter consistency test technology to distinguish leakage feature points from non-leakage feature points. If the fused data obtained in the previous step is regarded as a collection of leakage feature points and non-leakage feature points, then the leakage feature points are essentially outliers in the data set. Multi-factor variance analysis is simple, efficient and stable in distinguishing outliers, but there is a high probability of missed detection. Parameter consistency test technology effectively reduces the probability of missed detection, but there will be unstable performance (that is, the probability of "false positives" fluctuates). By combining multi-factor variance analysis and parameter consistency test technology, the advantages of both can be fully absorbed. While effectively reducing the probability of missed detection and false detection, the accuracy and robustness are more advantageous.

[0027] Preferably, in step S1, the data standardization technology adopted in this step is the Max-Min standardization technology, which achieves the purpose of placing the original data in a specific interval by replacing the original data with the ratio of the difference and deviation between it and the minimum value in the original data set. After that, a bandstop filter is used to filter the data in order to reduce noise. The reason for using bandstop filtering is that we found that the secret information of the cryptographic chip is not only contained in the low-frequency part of the collected signal, but also contains some high-frequency components. Finally, by using non-negative matrix decomposition (Nonnegative MatrixFactorization), the signal characteristic components are extracted, and the high-dimensional information pattern is simplified to a low-dimensional information pattern while keeping the information unchanged, thereby reducing the data complexity.

[0028] Preferably, in step S2, after processing in these two steps, the signal-to-noise ratio of each channel is further improved, data redundancy is greatly reduced, and the leakage characteristics of each channel can be fully combined to extract more hidden information compared to a single channel, thereby achieving a leakage detection effect of "1+1>2".

[0029] Preferably, in step S3, the main method of the leakage detection module is: first, the fused data set obtained in the previous steps (for the convenience of expression, denoted as F here) is respectively subjected to multi-factor analysis of variance and parameter consistency check to detect preliminary outlier point sets A and B; secondly, the intersection of the outlier point sets A and B is calculated, and used as a subset of the leakage point set D; then, after removing the point set after the intersection (i.e., the difference set of F and the intersection of A and B) from the fused data set, the three steps are repeated until the intersection of the outlier point sets A and B is an empty set.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] 1. The present invention generates new power consumption or electromagnetic signals through a diffusion model to achieve the purpose of increasing signals, and improves the signal-to-noise ratio through signal decomposition and fusion, thereby ensuring that it still has better detection performance under the premise of smaller sample data. For example, for an AES algorithm implemented on an MCU, this technology only requires about 3,000 samples to detect the leakage point, while the existing methods all require at least 10,000 samples to detect, reducing the measurement complexity;

[0032] 2. The present invention expands the signal samples and improves the signal-to-noise ratio through a series of measures, further integrates the data of different channels, and combines multi-factor variance analysis and parameter consistency verification technology to effectively reduce the probability of false detection and missed detection compared with the existing methods. For example, for an AES algorithm implemented on FPGA, compared with the existing method, when there are 50,000 data samples, the false detection and missed detection probabilities of the present invention technology are reduced by at least about 14% and 57%, respectively, thereby improving the efficiency of leakage detection;

[0033] 3. The present invention combines data from multiple signal sources and uses their complementary information to discover more leakage feature points that cannot be discovered by single-channel leakage detection alone. For example, for an AES FPGA implementation, the present invention finds as many as 200 hidden leakage feature points, and all of these leakage feature points can be used to successfully restore the algorithm key;

[0034] 4. The leakage feature point set detected by the technology of the present invention has the characteristics of low false detection and missed detection rate and wide coverage, which reduces the consumption of computing resources for subsequent side channel analysis while ensuring accuracy and improves the processing speed. For an AES MCU implementation, the present invention reduces the space occupancy of the original measurement signal by about 100 times, thereby greatly reducing the running time of subsequent side channel analysis, significantly improving analysis efficiency and reducing computational complexity. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A diagram showing the steps of the data preprocessing technology used in the present invention;

[0036] Figure 2 This is a framework diagram of the diffusion model based on KAN adopted in the present invention;

[0037] Figure 3 It is a schematic diagram of the power consumption and electromagnetic signal fusion steps of the present invention;

[0038] Figure 4 This is a working diagram of the leakage detection module of the present invention;

[0039] Figure 5 This is a traditional leak detection flow chart;

[0040] Figure 6 It is a flow chart of the technical solution of the present invention;

[0041] Figure 7 It is the configuration diagram of the side channel power consumption and electromagnetic signal acquisition of the cryptographic chip;

[0042] Figure 8 It is the Venn diagram of the relationship between the leakage detection point set and the actual leakage point set. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] The present invention provides an AES cryptographic chip leakage detection method combining power consumption and electromagnetic signals, and the method comprises the following steps:

[0045] S1, signal expansion module

[0046] This module mainly includes two steps: data preprocessing and data generation (generated using the diffusion model).

[0047] (1) Data preprocessing

[0048] Data preprocessing mainly uses data standardization, noise reduction and dimensionality reduction. Among them, the data standardization step aims to eliminate the influence of the signal reference voltage and make the signal variation amplitude within the same range; noise reduction is to reduce the adverse effects of noise; dimensionality reduction is to further improve the signal quality, highlight the "small signals" related to secret information, and reduce data complexity to a certain extent.

[0049] (2) Data Generation

[0050] The data generation module mainly uses the diffusion model to generate new power consumption or electromagnetic data of similar quality based on the collected power consumption or electromagnetic signals, so as to achieve the purpose of increasing the number of samples and the capacity of secret information without increasing the measurement complexity, which is conducive to statistical analysis and can better extract the secret information in the "small signal".

[0051] The present invention generates new data using an improved diffusion model, which is a diffusion model based on the Kolmogorov-Arnold network (abbreviated as KAN), that is, KAN is applied to the denoising U-net network in the diffusion model (so the model is abbreviated as DU-KAN here). From the overall architecture of DU-KAN, it can be seen that it belongs to a two-stage encoder-decoder architecture, including a convolution stage and a tokenized KAN stage. The input power consumption or electromagnetic signal passes through the encoder, wherein the first three blocks use convolution operations, followed by two tokenized KAN blocks, and the decoder also contains two tokenized KAN blocks, followed by three convolution blocks. Each encoder block reduces the feature resolution by half, while each decoder block doubles it. In addition, a jump connection is integrated between the encoder and the decoder, and the tokenized KAN block injects a learnable time embedding (module label "t" in the figure) to improve the network's time perception ability and enhance the effectiveness of generating time series. The number of channels of each block in the convolution stage and the tokenized KAN stage is determined by its hyperparameters respectively;

[0052] S2, signal fusion module

[0053] This module mainly includes two steps: signal decomposition (using variational model decomposition technology) and data fusion. Figure 3 shown.

[0054] (1) Signal decomposition

[0055] This step uses the variational mode decomposition (VMD) technology to adaptively achieve the frequency domain decomposition and effective separation of each component in the power consumption or electromagnetic signal by solving the frequency domain variational optimization problem. This method effectively separates the useful signal and noise in the power consumption or electromagnetic signal through iterative search, thereby achieving the purpose of improving the signal-to-noise ratio and enhancing the efficiency of leakage detection. In the present invention, the partial signal components containing secret information obtained by VMD decomposition are extracted for the next step of data fusion.

[0056] (2) Data Fusion

[0057] This step fuses the signal components extracted from the power consumption and electromagnetic channels in the previous steps, in order to simultaneously utilize the signal characteristics of different channels to extract more leakage information. The data fusion method adopted in this step belongs to the feature fusion method, that is, the singular value decomposition technology is used to obtain the left singular vector of the power consumption signal or the electromagnetic signal, and according to the principle of minimum total variation, the feature vector containing the secret information is extracted to form a feature vector set, and then the feature vectors of the two channels are recombined into a new fused signal set;

[0058] S3. Leakage detection module

[0059] This module mainly combines multi-factor variance analysis and parameter consistency test technology to distinguish leakage feature points from non-leakage feature points. If the fused data obtained in the previous step is regarded as a collection of leakage feature points and non-leakage feature points, then the leakage feature points are essentially outliers in the data set. Multi-factor variance analysis is simple, efficient and stable in distinguishing outliers, but there is a high probability of missed detection. Parameter consistency test technology effectively reduces the probability of missed detection, but there will be unstable performance (that is, the probability of "false positives" will fluctuate). By combining multi-factor variance analysis and parameter consistency test technology, the advantages of both are fully absorbed. While effectively reducing the probability of missed detection and false detection, accuracy and robustness are more advantageous.

[0060] In this embodiment: In step S1, the data standardization technology adopted in this step is the Max-Min standardization technology, which achieves the purpose of placing the original data in a specific interval by replacing the original data with the difference and deviation ratio between it and the minimum value in the original data set. After that, a bandstop filter is used to filter the data in order to reduce noise. The reason for using bandstop filtering is that we found that the secret information of the cryptographic chip is not only contained in the low-frequency part of the collected signal, but also contains some high-frequency components. Finally, by using non-negative matrix factorization, the signal feature components are extracted, and the high-dimensional information pattern is simplified to a low-dimensional information pattern while keeping the information unchanged, thereby reducing the data complexity. This step is as follows Figure 1 shown.

[0061] In this embodiment: In step S2, after the processing of these two steps, the signal-to-noise ratio of each channel is further improved, the data redundancy is greatly reduced, and the leakage characteristics of each channel can be fully combined to extract more hidden information compared to a single channel, thereby achieving a leakage detection effect of "1+1>2".

[0062] In this embodiment: In step S3, the main method of the leakage detection module is: first, the fused data set obtained in the previous step (for the convenience of expression, denoted as F here) is respectively subjected to multi-factor analysis of variance and parameter consistency check to detect preliminary outlier point sets A and B; secondly, the intersection of the outlier point sets A and B is calculated and used as a subset of the leakage point set D; then, after removing the point set after the intersection from the fused data set (i.e., the difference set of F and the intersection of A and B), the three steps are repeated until the intersection of the outlier point sets A and B is an empty set. The workflow of the leakage detection module is as follows: Figure 4shown.

[0063] 1. Feasibility and beneficial effects

[0064] The method of the present invention is based on combining the data of the power consumption channel and the electromagnetic channel, utilizing the complementary information of the two, and through data expansion and fusion, improving the signal-to-noise ratio, mining the hidden joint leakage information, and combining the advantages of multi-factor variance analysis and parameter consistency test to efficiently and stably detect leakage feature points. The technology adopted by the invention organically combines a variety of technologies in the fields of signal processing, machine learning and statistical analysis, has a solid theoretical foundation and rich practical applications, is highly feasible, and has the beneficial effects of low measurement complexity, low computational complexity, low false detection and missed detection rate, high leakage detection coverage rate and high joint leakage information extraction rate.

[0065] 2. Experimental process, results and data analysis

[0066] In order to verify the effectiveness of the technical solution of the present invention, the following two experiments were conducted on two cryptographic chips (MCU and FPGA implementation) running the AES-128 algorithm. The hardware equipment used in the experiment is a development board equipped with an 8-bit 8051 architecture microcontroller, a XILINX NEXYS A7 FPGA (Artix-7) development board, a Langer near-field electromagnetic probe, and a Tektronix mixed domain oscilloscope (Tektronix MDO3104). The side channel power consumption of the cryptographic chip and the electromagnetic signal acquisition configuration in the experiment are as follows: Figure 7 The parameter settings are shown in Table 1.

[0067] Table 1 Signal acquisition parameters

[0068]

[0069] In order to quantitatively evaluate the effect of the method of the present invention, the experiment uses three indicators: missed detection rate, false detection rate and leakage point coverage rate. These three measurement indicators are defined as follows:

[0070] R fn =|PD∩P| / |P|×100% (1)

[0071] R fp =|DD∩P| / |P|×100% (2)

[0072] R c =|D∩P| / |P|×100% (3)

[0073] Where D represents the set of leakage points detected by the leakage detection method, and P represents all the real leakage points contained in the side channel signal of the cryptographic chip. The relationship is as follows: Figure 8These three indicators measure the accuracy and efficiency of the leakage detection method.

[0074] The specific processes and results of the two experiments are briefly described as follows.

[0075] 1. The experimental process for AES MCU implementation is as follows:

[0076] Step 1: Data collection - Use an oscilloscope, voltage probe and electromagnetic probe to collect the power consumption data and electromagnetic data of the first round of operation of the AES cryptographic chip when encrypting 30,000 plain texts. Each data contains 100,000 samples. The power consumption signal data is stored as a Pow.csv file, and the electromagnetic radiation signal data is stored as an EM.csv file.

[0077] Step 2: Data preprocessing: Use MATLAB software to read Pow.csv and EM.csv files, and perform maximum and minimum normalization on the data, so that the amplitude of all signal data is distributed in [-1, 1]. Then, for each single-channel signal set, pass the signal through a band-stop filter (fl=50MHz, fh=450MHz), and expand the filtered signal into a one-dimensional vector in element order. Then, obtain the feature matrix (also a one-dimensional vector) through non-negative matrix decomposition, and reorganize it into a matrix with the same size as the original signal.

[0078] Step 3: Expand the signal set - Use the processed power consumption and electromagnetic data as training data and use the DU-KAN model to generate data sets of the same size respectively;

[0079] Step 4: Signal decomposition and fusion - Perform variational mode decomposition on each single-channel extended signal set obtained after the first three steps, select the first several components (the first 10 for power consumption signals, the 2nd to 11th for electromagnetic signals) for singular value decomposition. Then, for the two-channel signal data set, select the first 60 left singular vectors as the leakage feature set to reorganize into a new data set, and use it as a fused data set for the next step;

[0080] Step 5: Leakage detection - set the confidence level, use multi-factor variance analysis and parameter consistency test to detect outliers for the fused data set, take the intersection of two outliers as a subset of the leakage point set, and after excluding the intersection from the fused data set, repeat the same process again until the intersection is an empty set, and finally obtain the leakage point set.

[0081] The experimental results show that this technology only needs about 3,000 samples to detect leakage points, while existing methods all require at least 10,000 samples to detect. In addition, after using all the collected data, the missed detection rate, false detection rate, and leakage point coverage of this method are 1.44%, 0%, and 98.56%, respectively, which are at least 22.33, 8.54, and 22.33 percentage points higher than the existing methods. In addition, this method detects 79 joint hidden leakage points, which is at least 17 more than the existing methods, and can all be used to implement side channel attacks. The specific experimental results are shown in Table 2, in which the existing methods in the aforementioned literature are used as a comparison (power consumption and electromagnetic channel leakage detection are tested separately), and the optimal detection results obtained by these methods for each indicator are listed in the table to form a contrast with the method of the present invention.

[0082] Table 2 AES-128 MCU leak detection results

[0083]

[0084] 2. The experimental process for AES FPGA implementation is similar, as listed below:

[0085] Step 1: Data collection - Use an oscilloscope and an electromagnetic probe to collect the power consumption data and electromagnetic data of the last round of operations of the AES encryption chip when encrypting 500,000 plaintexts. Each data contains 5,000 samples. Store the power consumption signal data as a Pow.csv file, and the electromagnetic radiation signal data as an EM.csv file;

[0086] Step 2: Data preprocessing - Use MATLAB software to read Pow.csv and EM.csv files, and perform maximum and minimum normalization on the data, so that the amplitude of all signal data is distributed in [-1, 1]. After that, for each single-channel signal set, pass the signal through a band-stop filter (fl = 200MHz, fh = 800MHz), and expand the filtered signal into a one-dimensional vector in element order, and then obtain the feature matrix (also a one-dimensional vector) through non-negative matrix decomposition, and reorganize it into a matrix with the same size as the original signal;

[0087] Step 3: Expand the signal set - Use the processed power consumption and electromagnetic data as training data and use the DU-KAN model to generate data sets of the same size respectively;

[0088] Step 4: Signal decomposition and fusion - Perform variational mode decomposition on each single-channel extended signal set obtained after the first three steps, select the first several components and (the first three for power consumption signals, the second and third for electromagnetic signals) for singular value decomposition. Then, for the two-channel signal data set, select the first five left singular vectors as the leakage feature set to reorganize into a new data set, and use it as a fused data set for the next step;

[0089] Step 5: Leakage detection - set the confidence level, use multi-factor variance analysis and parameter consistency test to detect outliers for the fused data set, take the intersection of two outliers as a subset of the leakage point set, and after excluding the intersection from the fused data set, repeat the same process again until the intersection is an empty set, and finally obtain the leakage point set.

[0090] Experimental results show that this technology only needs about 8,000 samples to detect leakage points, while existing methods require at least 15,000 samples to detect. In addition, after using all the collected data, the missed detection rate, false detection rate, and leakage point coverage of this method are 0%, 9.26%, and 100%, respectively, which are at least 21.89, 39.4, and 21.89 percentage points higher than existing methods. In addition, this method detects 244 joint hidden leakage points, which is at least 31 more than existing methods, and they can all be used to implement side channel attacks.

[0091] Table 3 AES-128 FPGA implementation leakage detection results

[0092]

[0093] From the two experiments, it can be seen that the method proposed in the present invention is more feasible and practical than the existing method, and has the beneficial effects of low measurement complexity, low computational complexity, low false detection and missed detection rate, high leakage detection coverage rate and high joint leakage information extraction rate.

[0094] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0095] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. AES cryptographic chip leakage detection method combining power consumption and electromagnetic signals, characterized in that: The method comprises the following steps: S1, signal expansion module This module mainly includes two steps: data preprocessing and data generation (generated using the diffusion model). (1) Data preprocessing Data preprocessing mainly uses data standardization, noise reduction and dimensionality reduction. Among them, the data standardization step aims to eliminate the influence of the signal reference voltage and make the signal variation amplitude within the same range; noise reduction is to reduce the adverse effects of noise; dimensionality reduction is to further improve the signal quality, highlight the "small signals" related to secret information, and reduce data complexity to a certain extent. (2) Data Generation The data generation module mainly uses the diffusion model to generate new power consumption or electromagnetic data of similar quality based on the collected power consumption or electromagnetic signals, so as to achieve the purpose of increasing the number of samples and the capacity of secret information without increasing the measurement complexity, which is conducive to statistical analysis and can more fully extract the secret information in the "small signal". The present invention generates new data using an improved diffusion model, which is a diffusion model based on the Kolmogorov-Arnold network (abbreviated as KAN), that is, KAN is applied to the denoising U-net network in the diffusion model (so the model is abbreviated as DU-KAN here). It can be seen from the overall architecture of DU-KAN that it belongs to a two-stage encoder-decoder architecture, including a convolution stage and a tokenized KAN stage. The input power consumption or electromagnetic signal passes through the encoder, wherein the first three blocks utilize convolution operations, followed by two tokenized KAN blocks, and the decoder also contains two tokenized KAN blocks, followed by three convolution blocks, each encoder block halves the feature resolution, and each decoder block doubles it. In addition, a jump connection is integrated between the encoder and the decoder, and the tokenized KAN block injects a learnable time embedding to improve the network's time perception ability and enhance the effectiveness of generating time series. The number of channels of each block in the convolution stage and the tokenized KAN stage is determined by its hyperparameters respectively; S2, signal fusion module This module mainly includes two steps: signal decomposition (using variational model decomposition technology) and data fusion. (1) Signal decomposition This step uses variational mode decomposition (VMD) technology to adaptively achieve frequency domain decomposition and effective separation of components in power consumption or electromagnetic signals by solving frequency domain variational optimization problems. This method effectively separates useful signals and noise in power consumption or electromagnetic signals through iterative search, thereby achieving the purpose of improving the signal-to-noise ratio and enhancing the efficiency of leakage detection. In the present invention, some signal components containing secret information obtained by VMD decomposition are extracted for the next step of data fusion. (2) Data Fusion This step fuses the signal components extracted from the power consumption and electromagnetic channels in the previous steps, in order to simultaneously utilize the signal characteristics of different channels to extract more leakage information. The data fusion method adopted in this step belongs to the feature fusion method, that is, the singular value decomposition technology is used to obtain the left singular vector of the power consumption signal or the electromagnetic signal, and according to the principle of minimum total variation, the feature vector containing the secret information is extracted to form a feature vector set, and then the feature vectors of the two channels are recombined into a new fused signal set; S3. Leakage detection module This module mainly combines multi-factor variance analysis and parameter consistency test technology to distinguish leakage feature points from non-leakage feature points. If the fused data obtained in the previous step is regarded as a collection of leakage feature points and non-leakage feature points, then the leakage feature points are essentially outliers in the data set. Multi-factor variance analysis is simple, efficient and stable in distinguishing outliers, and there is a high probability of missed detection. Parameter consistency test technology effectively reduces the probability of missed detection, but there will be unstable performance (that is, the probability of "false positives" will fluctuate). By combining multi-factor variance analysis and parameter consistency test technology, the advantages of both can be fully absorbed. While effectively reducing the probability of missed detection and false detection, accuracy and robustness are more advantageous.

2. The AES cryptographic chip leakage detection method combining power consumption and electromagnetic signals according to claim 1 is characterized in that: In the step S1, the data standardization technology adopted in this step is the Max-Min standardization technology, which achieves the purpose of placing the original data in a specific interval by replacing the original data with the difference and deviation ratio between it and the minimum value in the original data set. After that, a bandstop filter is used to filter the data in order to reduce noise. The reason for using bandstop filtering is that we found that the secret information of the cryptographic chip is not only contained in the low-frequency part of the collected signal, but also contains some high-frequency components. Finally, by using non-negative matrix factorization, the signal feature components are extracted, and the high-dimensional information pattern is simplified to a low-dimensional information pattern while keeping the information unchanged, thereby reducing the data complexity.

3. The AES cryptographic chip leakage detection method combining power consumption and electromagnetic signals according to claim 1 is characterized in that: In step S2, after the processing of these two steps, the signal-to-noise ratio of each channel is further improved, the data redundancy is greatly reduced, and the leakage characteristics of each channel can be fully combined to extract more hidden information compared to a single channel, thereby achieving a leakage detection effect of "1+1>2".

4. The AES cryptographic chip leakage detection method combining power consumption and electromagnetic signals according to claim 1 is characterized in that: In step S3, the main method of the leakage detection module is as follows: first, the fused data set obtained in the previous steps (referred to as F here for convenience) is subjected to multi-factor analysis of variance and parameter consistency check respectively to detect preliminary outlier point sets A and B; secondly, the intersection of the outlier point sets A and B is calculated and used as a subset of the leakage point set D; then, after removing the point set after the intersection (i.e., the difference set of F and the intersection of A and B) from the fused data set, the three steps are repeated until the intersection of the outlier point sets A and B is an empty set.

Images