Side channel attack resisting method and device, computer equipment and storage medium

Abstract

The invention relates to a side channel attack resisting method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring an input message and an elliptic curve parameter; extracting verification points from the elliptic curve parameters, and judging whether the verification points meet the elliptic curve equation or not; generating a first random number, and performing blind processing on the first random number and the verification point to obtain a product of the first random number and the verification point; generating a signature based on the verification point and the elliptic curve parameter; and outputting the signature and the input message under the condition that the signature verification is passed. By combining multiple blinding and random number masking, the privacy and integrity of signature generation and message transmission are ensured, and the security protection capability of the system is remarkably improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method, apparatus, computer device and storage medium for resisting side-channel attacks. Background Art

[0002] As the current mainstream elliptic curve public key cryptography algorithm, ECC (Elliptic Curve Cryptography) is widely used in the financial IT industry and is widely used in commercial cryptographic chips. As ECC is widely used in the commercial field, side channel attacks against the ECC algorithm are increasing, including side channel methods against elliptic curves (active attacks and passive attacks). Therefore, the application of security chips equipped with this algorithm in cryptographic devices such as cryptographic cards faces severe challenges.

[0003] In traditional ECC implementations, the side channel protection of ECC mainly relies on the blinding method of point multiplication operations to make its power consumption smooth and balanced. This method can effectively resist power consumption analysis and electromagnetic analysis, but for the entire decryption and signing process, it is not only the point multiplication that needs to be protected, but also other sensitive calculations, so the entire process does not achieve the protection effect. Summary of the invention

[0004] Based on this, it is necessary to provide a method, device, computer equipment and storage medium for resisting side-channel attacks that can protect the entire process of encryption, decryption and signing in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for resisting side channel attacks, the method comprising:

[0006] Get the input message and elliptic curve parameters;

[0007] Extract verification points from elliptic curve parameters and determine whether the verification points satisfy the elliptic curve equation;

[0008] Generate a first random number, perform blinding on the first random number and the verification point, and obtain the product of the first random number and the verification point;

[0009] Generate a signature based on the verification point and the elliptic curve parameters;

[0010] When the signature verification passes, the signature and input message are output.

[0011] In one embodiment, obtaining an input message and an elliptic curve parameter, and performing a hash operation on the input message includes:

[0012] Get the message length of the input message;

[0013] A first hash calculation is performed on the elliptic curve parameter, the input message, and the message length to obtain a first hash value.

[0014] In one embodiment, generating a first random number, blinding the first random number and the verification point, and obtaining the product of the first random number and the verification point includes:

[0015] Generate a first random number and a second random number, and blind the first random number according to the second random number and an elliptic curve parameter to obtain a blinded first random number;

[0016] Blind processing is performed on the projection coordinates of the verification point to obtain a blinded verification point; and then the product of the blinded first random number and the blinded verification point is obtained;

[0017] The product of the blinded first random number and the blinded verification point is calculated by bit query to obtain the product of the first random number and the verification point.

[0018] In one embodiment, generating a first random number and a second random number, blinding the first random number according to the second random number and an elliptic curve parameter, and obtaining the blinded first random number includes:

[0019] Generate a first random number, a fourth random number, a fifth random number, a sixth random number, a seventh random number, and an eighth random number;

[0020] inputting the fourth random number and the fifth random number into the first storage unit and the second storage unit respectively;

[0021] Inputting the second random number and the elliptic curve parameter into the first storage unit and the second storage unit respectively;

[0022] sequentially inputting the sixth random number and the first random number into the second storage unit;

[0023] The seventh random number and the eighth random number are input into the first storage unit and the second storage unit respectively to obtain a blinded first random number.

[0024] In one embodiment, calculating the product of the blinded first random number and the blinded verification point by bit query to obtain the product of the first random number and the verification point includes:

[0025] Obtain the bit value of the most significant bit 1 in the first blinded random number;

[0026] When the bit value is 1, the double point operation and the point addition operation are performed on the blinded verification point in sequence, the point addition operation result is stored in the upper half of the first storage unit, and the double point operation result is stored in the lower half of the first storage unit;

[0027] When the bit value is 0, the double point operation and the point addition operation are performed on the blinded verification point in sequence, and the result of the double point operation is stored in the upper half of the first storage unit, and the result of the point addition operation is stored in the lower half of the first storage unit.

[0028] In one embodiment, generating a signature based on a verification point and elliptic curve parameters includes:

[0029] Obtaining a first signature parameter according to the verification point and the elliptic curve parameter;

[0030] Obtain a private key and a third random parameter, and obtain a second signature parameter according to the private key, the third random parameter and the first signature parameter;

[0031] Generate a signature based on the first signature parameter and the second signature parameter.

[0032] In one embodiment, after generating a signature based on the verification point and the elliptic curve parameters, the method further includes:

[0033] Performing a second hash operation on the elliptic curve parameter, the input message, and the message length to obtain a second hash value;

[0034] If the second hash value is equal to the first hash value, the signature is verified.

[0035] In a second aspect, the present application also provides a device for resisting side channel attacks. The device comprises:

[0036] An acquisition module, used to obtain input messages and elliptic curve parameters;

[0037] A verification module, used to extract verification points from elliptic curve parameters and determine whether the verification points satisfy the elliptic curve equation;

[0038] A blinding module, used to generate a first random number, perform blinding processing on the first random number and the verification point, and obtain the product of the first random number and the verification point;

[0039] A signature module, used to generate a signature based on the verification point and elliptic curve parameters;

[0040] The output module is used to output the signature and input message when the signature verification passes.

[0041] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, the memory includes a plurality of storage units, and the processor implements the following steps when executing the computer program:

[0042] Get the input message and elliptic curve parameters;

[0043] Extract verification points from elliptic curve parameters and determine whether the verification points satisfy the elliptic curve equation;

[0044] Generate a first random number, perform blinding on the first random number and the verification point, and obtain the product of the first random number and the verification point;

[0045] Generate a signature based on the verification point and the elliptic curve parameters;

[0046] When the signature verification passes, the signature and input message are output.

[0047] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0048] Get the input message and elliptic curve parameters;

[0049] Extract verification points from elliptic curve parameters and determine whether the verification points satisfy the elliptic curve equation;

[0050] Generate a first random number, perform blinding on the first random number and the verification point, and obtain the product of the first random number and the verification point;

[0051] Generate a signature based on the verification point and the elliptic curve parameters;

[0052] When the signature verification passes, the signature and input message are output.

[0053] The above-mentioned anti-side channel attack method, device, computer equipment and storage medium generate a first random number and blind the first random number and the verification point, so that even if the attacker can obtain the external leaked signal during the calculation process, it cannot be directly associated with the actual input information; the blinding process ensures the randomization of key operation data, so that the correlation between power consumption or other signals and actual operations is greatly reduced, thereby effectively preventing information leakage in side channel attacks. In addition, in the signature generation and verification process, by combining multiple blinding and random number masking, the privacy and integrity of signature generation and message transmission are ensured, which significantly improves the security protection capability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] FIG1 is a diagram of an application environment of a method for resisting side channel attacks in one embodiment;

[0055] FIG2 is a schematic diagram of a flow chart of a method for resisting side channel attacks in one embodiment;

[0056] FIG3 is a schematic diagram of a flow chart of a method for resisting side channel attacks in another embodiment;

[0057] FIG4 is a structural block diagram of a device for resisting side channel attacks in one embodiment;

[0058] FIG. 5 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0060] The anti-side channel attack method provided in the embodiment of the present application can be applied in the application environment shown in Figure 1. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. Among them, the terminal 102 can be but is not limited to various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0061] In one embodiment, as shown in FIG. 2 , a method for resisting side channel attacks is provided, which is described by taking the method applied to the server in FIG. 1 as an example, and includes the following steps:

[0062] Step 202: Obtain input message and elliptic curve parameters.

[0063] Step 204, extracting a verification point from the elliptic curve parameters, and determining whether the verification point satisfies the elliptic curve equation.

[0064] Step 206, generate a first random number, perform blinding processing on the first random number and the verification point, and obtain the product of the first random number and the verification point.

[0065] Step 208, generating a signature based on the verification point and the elliptic curve parameters.

[0066] Step 210: When the signature verification passes, the signature and the input message are output.

[0067] Among them, the elliptic curve parameters are the elliptic curve equation parameters in the ECC (Elliptic Curve Cryptography) algorithm. The elliptic curve parameters mainly include elliptic curve coefficients, prime numbers, base point coordination factors and order N; the signature is generated by the private key and is used to verify the identity of the sender of the input message; the blinding process is to randomize the input message, and the signature of the trusted party can be obtained without revealing the input message.

[0068] Specifically, firstly, a hash operation is performed on the input message, and the verification point is extracted from the elliptic curve parameters to determine whether the verification point satisfies the elliptic curve equation, that is, whether the verification point falls on the elliptic curve. When the verification point does not fall on the elliptic curve, the program is exited to avoid error injection attacks during the signature generation process; when the verification point falls on the elliptic curve, a first random number is generated. The first random number and the verification point are blinded respectively to obtain the product of the blinded first random number and the blinded verification point; the product of the first random number and the verification point is obtained by querying the product of the blinded first random number and the blinded verification point. A signature is generated based on the verification point and the elliptic curve parameters, and the signature is verified. If the verification passes, the signature and the input message are output.

[0069] In the above-mentioned anti-side channel attack method, by generating a first random number and blinding the first random number and the verification point, even if the attacker can obtain the external leaked signal during the calculation process, it cannot be directly associated with the actual input information; the blinding process ensures the randomization of key operation data, so that the correlation between power consumption or other signals and actual operations is greatly reduced, thereby effectively preventing information leakage in side channel attacks. In addition, in the signature generation and verification process, by combining multiple blinding and random number masking, the privacy and integrity of signature generation and message transmission are ensured, which significantly improves the security protection capability of the system.

[0070] In one embodiment, obtaining an input message and elliptic curve parameters, and performing a hash operation on the input message includes: obtaining a message length of the input message; performing a first hash calculation on the elliptic curve parameters, the input message, and the message length to obtain a first hash value.

[0071] Specifically, the message length of the input message is extracted from the input message, and a first hash calculation is performed on the elliptic curve parameter, the input message and the message length, as shown in the following formula:

[0072]

[0073] Where param1 is the first hash value, eccPrams is the elliptic curve parameter, m is the input message, and len is the length of the input message.

[0074] In this embodiment, by performing a first hash calculation on the elliptic curve parameters, input message and message length, the consistency of the input message and related parameters in the entire signature generation and verification process is ensured, preventing the message from being tampered with during transmission or processing or being attacked by error injection during the calculation process, thereby enhancing the security of input message transmission and processing.

[0075] In one embodiment, generating a first random number, blinding the first random number and a verification point, and obtaining the product of the first random number and the verification point includes: generating a first random number and a second random number, blinding the first random number according to the second random number and an elliptic curve parameter to obtain a blinded first random number; blinding the projected coordinates of the verification point to obtain a blinded verification point; and then obtaining the product of the blinded first random number and the blinded verification point; obtaining the product of the blinded first random number and the blinded verification point by bit query to obtain the product of the first random number and the verification point.

[0076] Specifically, the first random number after blinding is:

[0077]

[0078] In the formula, is the first random number after blinding, k is the first random number, k1 is the second random number, and is a true random number, and N is the order in the elliptic curve parameter. The product of the first random number after blinding and the verification point is:

[0079]

[0080] In the formula, G is the verification point, O is the point at infinity, also known as the unit element, which represents the "zero" element of elliptic curve addition, and the blinded first random number can make the power consumption generated by the operation uncorrelated with the first random number.

[0081] The projection coordinates of the verification point are blinded. First, the ninth random number is generated, and the projection coordinates (x, y, z) of the verification point are blinded to obtain the blinded verification point. ,Right now:

[0082]

[0083]

[0084]

[0085] The blinded verification point can make the power consumption generated by the operation irrelevant to the verification point. The product of the blinded first random number and the blinded verification point is calculated by bit query to obtain the product of the first random number and the verification point.

[0086] In this embodiment, the blinded random numbers and verification points make the power consumption independent of the original data during the calculation process, effectively reducing the risk of side channel attacks such as power consumption analysis; by blinding the coordinates of the verification points, it is ensured that there is no obvious correlation between the verification points and the power consumption, thereby resisting the attack method of inferring internal data by analyzing the changes in power consumption, so that during the entire calculation process, the attacker cannot obtain any useful side channel information, thereby ensuring the safety and reliability of the operation.

[0087] In one embodiment, generating a first random number and a second random number, blinding the first random number according to the second random number and an elliptic curve parameter, and obtaining the blinded first random number includes: generating a first random number, a fourth random number, a fifth random number, a sixth random number, a seventh random number, and an eighth random number; inputting the fourth random number and the fifth random number into a first storage unit and a second storage unit, respectively; inputting the second random number and the elliptic curve parameter into the first storage unit and the second storage unit, respectively; inputting the sixth random number and the first random number into the second storage unit in sequence; inputting the seventh random number and the eighth random number into the first storage unit and the second storage unit, respectively, to obtain the blinded first random number.

[0088] Among them, Hamming Weight refers to the number of bits with a value of 1 in a binary number, that is, Hamming Weight represents the number of "1" in a binary number.

[0089] Exemplarily, the modulus of 16 full 0xFFFFFFFF words is input into the third storage unit. A fourth random number and a fifth random number are generated, and the fourth random number and the fifth random number are true random numbers; the fourth random number is input into the first storage unit, and the fifth random number is input into the second storage unit, that is, the first storage unit and the second storage unit are firstly covered with true random numbers. This prevents the real data input later from leaking its Hamming weight. Then the first random number and the order in the elliptic curve parameter are input, the first random number is input into the first storage unit, the order in the elliptic curve parameter is input into the second storage unit, a modular multiplication operation is performed on the scalar of the elliptic curve parameter, and the operation result is input into the first storage unit. A sixth random number is generated, and the sixth random number is a true random number, and the sixth random number is input into the second storage unit, that is, the second storage unit is first covered with true random numbers to prevent the real data input later from leaking its Hamming weight. The first random number is input into the second storage unit, and a modular addition operation is performed to obtain the blinded first random number. Generate a seventh random number and an eighth random number, and the seventh random number and the eighth random number are true random numbers; input the seventh random number into the first storage unit, and input the eighth random number into the second storage unit, that is, use true random numbers to lay the foundation for the first storage unit and the second storage unit to prevent the real result data from leaking its Hamming weight. Among them, the blinding steps for the first random number and the verification point adopt the above steps to access each storage unit in hardware reality.

[0090] In this embodiment, when the first random number and the elliptic curve parameter are input and output from the first storage unit and the second storage unit, a true random number is generated to pave the first storage unit and the second storage unit to prevent the real result data from leaking its Hamming weight; and in the process of inputting and outputting data, the data is input and output in a random order to disrupt the power consumption curve, avoid obtaining useful information through time or power consumption analysis, and perform anti-side channel protection.

[0091] In one embodiment, calculating the product of the blinded first random number and the blinded verification point by bit query to obtain the product of the first random number and the verification point includes: obtaining the bit value of the highest bit 1 in the blinded first random number; when the bit value is 1, performing a doubling operation and a point addition operation on the blinded verification point in sequence, storing the result of the point addition operation in the upper half of the first storage unit, and storing the result of the doubling operation in the lower half of the first storage unit; when the bit value is 0, performing a doubling operation and a point addition operation on the blinded verification point in sequence, storing the result of the doubling operation in the upper half of the first storage unit, and storing the result of the point addition operation in the lower half of the first storage unit.

[0092] Exemplarily, the elliptic curve parameters are input into the third storage unit, the blinded verification point is input into the first storage unit and the second storage unit, and the blinded second random number is input into the fourth storage unit. The position nb of the highest bit 1 of the blinded second random number is obtained, and the following operations are performed from i=nb-1 to i=0 to obtain the product of the first random number and the first verification point:

[0093] (1) Take out the second random number after blinding The i-th bit value in , denoted as k1b.

[0094] (2) If k1b=1, perform doubling operation first =2 , and then perform point addition operation , store the point addition result in the upper half of the first storage unit, store the doubling result in the lower half of the first storage unit, i=i-1, return to step (1).

[0095] (3) If k1b=0, perform doubling operation first =2 , and then perform point addition operation , store the doubling result in the upper half of the first storage unit, store the dot addition result in the lower half of the first storage unit, i=i-1, return to step (1).

[0096] In this embodiment, doubling and addition operations are performed on the blinded second random number. Regardless of whether the corresponding bit of the blinded second random number is 0 or 1, doubling and addition operations are performed, thereby achieving complete consistency of 0 and 1 operations, and the storage units accessed by the computing hardware are also consistent, avoiding power consumption leakage during the hardware computing process, thereby effectively resisting related power consumption attacks.

[0097] In one embodiment, generating a signature based on a verification point and elliptic curve parameters includes: obtaining a first signature parameter based on the verification point and the elliptic curve parameters; obtaining a private key and a third random parameter, and obtaining a second signature parameter based on the private key, the third random parameter and the first signature parameter; and generating a signature based on the first signature parameter and the second signature parameter.

[0098] Specifically, according to the verification point coordinates and the order in the elliptic curve parameters, the first signature parameter is obtained, as shown in the following formula:

[0099]

[0100] Where R is the first signature parameter, x1 is the horizontal coordinate in the verification point coordinates, and N is the order in the elliptic curve parameter. Generate a third random number, and obtain the second random parameter based on the third random number and the private key, as shown in the following formula:

[0101]

[0102] In the formula, k1 is the second random parameter, k is the first random parameter, and r is the third random parameter; and the second random parameter is inverted to obtain .

[0103] Calculate the hash value of the input message And for the second signature parameter Perform side channel protection: According to the third random number, get Z a1 , as shown below:

[0104]

[0105] Generate the tenth random number and get da1, da2, da3, as shown in the following formula:

[0106]

[0107]

[0108]

[0109] According to da1, da2, da3, S1 and S2 are obtained, and the second signature parameter is calculated, as shown in the following formula:

[0110]

[0111]

[0112]

[0113]

[0114]

[0115] Among them, Z a1 , da1, da2, da3, S1, and S2 are all calculation process parameters.

[0116] In this embodiment, the first signature parameter is obtained by calculating the coordinates of the verification point, and the second signature parameter is generated in combination with the private key and the third random parameter, thereby ensuring the uniqueness of the signature and enhancing the protection against random number leakage through multiple randomization processes.

[0117] In one embodiment, after generating a signature based on the verification point and the elliptic curve parameters, it also includes: performing a second hash operation on the elliptic curve parameters, the input message and the message length to obtain a second hash value; and verifying the signature if the second hash value is equal to the first hash value.

[0118] Specifically, a second hash operation is performed on the elliptic curve parameters, the input message, and the message length, as shown in the following formula:

[0119]

[0120] Where param2 is the second hash value, eccPrams is the elliptic curve parameter, m is the input message, and len is the length of the input message. Compare whether the first hash value is equal to the second hash value. If the first hash value is equal to the second hash value, then verify the signature; if the first hash value is different from the second hash value, then it is determined that an error injection attack has occurred and the operation ends.

[0121] In this embodiment, after generating a signature based on the verification point and elliptic curve parameters, a second hash operation is added, and the first hash value is compared with the second hash value, thereby further enhancing the security of the signature verification process. If the results of the two hash operations are consistent, it means that the input message and related parameters have not been tampered with or interfered with during the signature generation process, and the signature verification can be performed safely; if the hash values ​​are inconsistent, possible error injection attacks are detected in time, thereby terminating the operation and avoiding potential security threats. The ability to resist side channel attacks is effectively improved, especially against error injection attacks, and the integrity and security of data during transmission and processing are guaranteed.

[0122] In one embodiment, referring to FIG3 , a method for resisting side channel attacks is provided, comprising the following steps:

[0123] Step 302: Obtain input message and elliptic curve parameters.

[0124] Step 304: Obtain the message length of the input message.

[0125] Step 306: Perform a first hash calculation on the elliptic curve parameters, the input message, and the message length to obtain a first hash value.

[0126] Step 308: extract the verification point from the elliptic curve parameters and determine whether the verification point satisfies the elliptic curve equation.

[0127] Step 310, generate a first random number, a fourth random number, a fifth random number, a sixth random number, a seventh random number, and an eighth random number.

[0128] Step 312: input the fourth random number and the fifth random number into the first storage unit and the second storage unit respectively.

[0129] Step 314: input the second random number and the elliptic curve parameter into the first storage unit and the second storage unit respectively.

[0130] Step 316: input the sixth random number and the first random number into the second storage unit in sequence.

[0131] Step 318: input the seventh random number and the eighth random number into the first storage unit and the second storage unit respectively to obtain a blinded first random number.

[0132] Step 320, blinding the projection coordinates of the verification point to obtain a blinded verification point; and then obtaining the product of the blinded first random number and the blinded verification point.

[0133] Step 322, obtaining the bit value of the most significant bit 1 in the blinded first random number.

[0134] Step 324, when the bit value is 1, perform doubling operation and point addition operation on the blinded verification point in sequence, store the point addition operation result in the upper half of the first storage unit, and store the doubling operation result in the lower half of the first storage unit.

[0135] Step 326, when the bit value is 0, perform doubling operation and point addition operation on the blinded verification point, store the doubling operation result in the upper half of the first storage unit, and store the point addition operation result in the lower half of the first storage unit.

[0136] Step 328, obtaining the first signature parameter according to the verification point and the elliptic curve parameter.

[0137] Step 330: Obtain a private key and a third random parameter, and obtain a second signature parameter according to the private key, the third random parameter and the first signature parameter.

[0138] Step 332: Generate a signature according to the first signature parameter and the second signature parameter.

[0139] Step 334: Perform a second hash operation on the elliptic curve parameters, the input message, and the message length to obtain a second hash value.

[0140] Step 336: If the second hash value is equal to the first hash value, verify the signature.

[0141] Step 338: When the signature verification passes, the signature and input message are output.

[0142] In this embodiment, by generating a first random number and blinding the first random number and the verification point, even if the attacker can obtain the external leaked signal during the calculation process, it cannot be directly associated with the actual input information; the blinding process ensures the randomization of key operation data, so that the correlation between power consumption or other signals and actual operations is greatly reduced, thereby effectively preventing information leakage in side channel attacks. In addition, in the signature generation and verification process, by combining multiple blinding and multiple random number masking, the privacy and integrity of signature generation and message transmission are ensured, and the security protection capability of the system is significantly improved. And the circuit implementation is simple, the overall operation is a transformation of the existing operation, there is no complex operation logic, and the decryption and signing methods are similar, without adding additional circuit overhead. Therefore, the hardware utilization rate is higher during implementation, and it is conducive to the implementation of the entire algorithm on a smaller circuit area.

[0143] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are shown in sequence, these steps are not necessarily executed in sequence in the order indicated. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the steps or stages in other steps.

[0144] Based on the same inventive concept, the embodiment of the present application also provides an anti-side channel attack device for implementing the anti-side channel attack method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more anti-side channel attack device embodiments provided below can refer to the limitations of the anti-side channel attack method above, and will not be repeated here.

[0145] In one embodiment, as shown in FIG. 4 , a device for resisting side channel attacks is provided, including: a first acquisition module 402, a verification module 404, a blinding module 406, a signature module 408, and an output module 410, wherein:

[0146] The first acquisition module 402 is used to acquire an input message and elliptic curve parameters.

[0147] The verification module 404 is used to extract verification points from the elliptic curve parameters and determine whether the verification points satisfy the elliptic curve equation.

[0148] The blinding module 406 is used to generate a first random number, perform blinding processing on the first random number and the verification point, and obtain the product of the first random number and the verification point.

[0149] The signature module 408 is used to generate a signature based on the verification point and the elliptic curve parameters.

[0150] The output module 410 is used to output the signature and the input message when the signature verification passes.

[0151] In one embodiment, the anti-side channel attack device further includes:

[0152] The second acquisition module is used to acquire the message length of the input message.

[0153] The first hash module is used to perform a first hash calculation on the elliptic curve parameter, the input message and the message length to obtain a first hash value.

[0154] In one embodiment, the blinding module 406 includes:

[0155] The generation module is used to generate a first random number and a second random number, and blind the first random number according to the second random number and an elliptic curve parameter to obtain a blinded first random number.

[0156] The first blinding module is used to perform blinding processing on the projection coordinates of the verification point to obtain the blinded verification point; and then obtain the product of the blinded first random number and the blinded verification point.

[0157] The bit query module is used to calculate the product of the blinded first random number and the blinded verification point by means of bit query to obtain the product of the first random number and the verification point.

[0158] In one embodiment, the generation module includes:

[0159] The sub-generation module is used to generate a first random number, a fourth random number, a fifth random number, a sixth random number, a seventh random number, and an eighth random number.

[0160] The first storage module is used to input the fourth random number and the fifth random number into the first storage unit and the second storage unit respectively.

[0161] The second storage module is used to input the second random number and the elliptic curve parameter into the first storage unit and the second storage unit respectively.

[0162] The third storage module is used to input the sixth random number and the first random number into the second storage unit in sequence.

[0163] The fourth storage module is used to input the seventh random number and the eighth random number into the first storage unit and the second storage unit respectively to obtain a blinded first random number.

[0164] In one embodiment, the bit query module includes:

[0165] The third acquisition module is used to obtain the bit value of the most significant bit 1 in the blinded first random number.

[0166] The fifth storage module is used to perform point doubling operation and point addition operation on the blinded verification point in sequence when the bit value is 1, store the point addition operation result in the upper half of the first storage unit, and store the point doubling operation result in the lower half of the first storage unit.

[0167] The sixth storage module is used to perform doubling operation and point addition operation on the blinded verification point in sequence when the bit value is 0, store the doubling operation result in the upper half of the first storage unit, and store the point addition operation result in the lower half of the first storage unit.

[0168] In one embodiment, the signature module 408 includes:

[0169] The first parameter module is used to obtain a first signature parameter according to the verification point and the elliptic curve parameter.

[0170] The second parameter module is used to obtain a private key and a third random parameter, and obtain a second signature parameter according to the private key, the third random parameter and the first signature parameter.

[0171] The signature generation module is used to generate a signature according to the first signature parameter and the second signature parameter.

[0172] In one embodiment, it further includes:

[0173] The second hash module is used to perform a second hash operation on the elliptic curve parameters, the input message and the message length to obtain a second hash value.

[0174] The signature verification module is used to verify the signature when the second hash value is equal to the first hash value.

[0175] Each module in the above-mentioned anti-side channel attack device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0176] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for resisting side channel attacks is implemented.

[0177] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be shown in FIG5. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. The processor, the memory, and the input / output interface are connected via a system bus, and the communication interface, the display unit, and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner may be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a method for resisting side channel attacks is implemented. The display unit of the computer device is used to form a visually visible picture, which may be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0178] Those skilled in the art will understand that the structure shown in FIG. 5 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0179] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the memory includes a plurality of storage units, and when the processor executes, the steps in the above method embodiments are implemented.

[0180] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0181] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0182] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0183] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0184] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for resisting side channel attacks, characterized in that: The method comprises: Get the input message and elliptic curve parameters; Extracting a verification point from the elliptic curve parameters, and determining whether the verification point satisfies the elliptic curve equation; Generate a first random number, perform blinding processing on the first random number and the verification point, and obtain the product of the first random number and the verification point; generating a signature based on the verification point and the elliptic curve parameters; When the signature verification passes, the signature and the input message are output.

2. The method according to claim 1, characterized in that The step of obtaining an input message and an elliptic curve parameter and performing a hash operation on the input message comprises: Get the message length of the input message; A first hash calculation is performed on the elliptic curve parameter, the input message, and the message length to obtain a first hash value.

3. The method according to claim 1, characterized in that The generating of the first random number and blinding the first random number and the verification point to obtain the product of the first random number and the verification point comprises: Generate a first random number and a second random number, and blind the first random number according to the second random number and the elliptic curve parameter to obtain the blinded first random number; Blinding the projection coordinates of the verification point to obtain the blinded verification point; and then obtaining the product of the blinded first random number and the blinded verification point; The product of the blinded first random number and the blinded verification point is calculated by bit query to obtain the product of the first random number and the verification point.

4. The method according to claim 3, characterized in that Generating a first random number and a second random number, and blinding the first random number according to the second random number and the elliptic curve parameter to obtain the blinded first random number includes: Generate a first random number, a fourth random number, a fifth random number, a sixth random number, a seventh random number, and an eighth random number; Inputting the fourth random number and the fifth random number into the first storage unit and the second storage unit respectively; Input the second random number and the elliptic curve parameter into a first storage unit and a second storage unit respectively; sequentially inputting the sixth random number and the first random number into the second storage unit; The seventh random number and the eighth random number are input into the first storage unit and the second storage unit respectively to obtain a blinded first random number.

5. The method according to claim 4, characterized in that The step of calculating the product of the blinded first random number and the blinded verification point by bit query to obtain the product of the first random number and the verification point includes: Obtain the bit value of the most significant bit 1 in the first blinded random number; When the bit value is 1, performing a doubling operation and a point addition operation on the blinded verification point, storing the point addition operation result in the upper half of the first storage unit, and storing the doubling operation result in the lower half of the first storage unit; When the bit value is 0, a doubling operation and a point addition operation are performed on the blinded verification point in sequence, and the doubling operation result is stored in the upper half of the first storage unit, and the point addition operation result is stored in the lower half of the first storage unit.

6. The method according to claim 1, characterized in that Generating a signature based on the verification point and the elliptic curve parameter comprises: Obtaining a first signature parameter according to the verification point and the elliptic curve parameter; Obtain a private key and a third random parameter, and obtain a second signature parameter according to the private key, the third random parameter and the first signature parameter; The signature is generated according to the first signature parameter and the second signature parameter.

7. The method according to claim 2, characterized in that After generating the signature based on the verification point and the elliptic curve parameter, the method further includes: Performing a second hash operation on the elliptic curve parameter, the input message, and the message length to obtain a second hash value; If the second hash value is equal to the first hash value, the signature is verified.

8. A device for resisting side channel attacks, characterized in that: The device comprises: An acquisition module, used to obtain input messages and elliptic curve parameters; A verification module, used to extract a verification point from the elliptic curve parameters and determine whether the verification point satisfies the elliptic curve equation; A blinding module, used for generating a first random number, performing blinding processing on the first random number and the verification point, and obtaining a product of the first random number and the verification point; A signature module, configured to generate a signature based on the verification point and the elliptic curve parameters; The output module is used to output the signature and the input message when the signature verification passes.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: The memory includes a plurality of storage units, and the processor implements the steps of the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images