Cryptographic algorithm side channel analysis method based on manifold learning

Abstract

The invention relates to the field of information security passwords, in particular to a cryptographic algorithm side channel analysis method based on manifold learning, which comprises the following steps of: firstly, acquiring energy information of equipment running a cryptographic algorithm, analyzing the acquired energy trace, positioning and executing a key operation position related to a secret key, and dividing the key operation position into a plurality of operation sections; secondly, performing feature extraction on the operation section by applying a manifold learning algorithm, and mapping the operation section of a high-dimensional waveform space to a low-dimensional feature space; and finally, classifying the feature points by adopting a hierarchical clustering algorithm, recovering a key operation type according to a classification result, finally obtaining a key, and realizing automatic side channel analysis of a cryptographic algorithm.

Description

Technical Field

[0001] The present disclosure relates to the field of information security cryptography, and more specifically, to a cryptographic algorithm side channel analysis method based on manifold learning. Background Art

[0002] With the development of the Internet of Things, public key cryptography (PKC) is widely used in embedded security applications such as smart cards, radio frequency identification tags, smartphones and smart homes. PKC's representative algorithms RSA and elliptic curve cryptography (ECC) have been widely used in various IoT devices. The security of the algorithm implementation and the anti-attack capability of the cryptographic components are crucial.

[0003] When executing the PKC algorithm on an IoT device, it will inevitably cause fluctuations in the physical state of the device, and information such as time, power consumption, and electromagnetic radiation will inevitably be leaked; in 1999, Kocher proposed Simple Power Analysis (SPA), which uses the execution time changes caused by different operations in branch statements to recover the exponent bits of the RSA secret key; the core of SPA is to use the feature differences and statistical characteristics between multiple fragments to recover secret information in a small number of waveforms or even a single waveform; the side channel analysis of PKC mainly focuses on identifying cryptographic operations that are closely related to secret information.

[0004] At present, many SPAs for PKC choose to use dimensionality reduction algorithms to extract feature points of cryptographic operation segments. Many of these schemes will choose unsupervised dimensionality reduction algorithms, such as PCA, t-SNE, etc.; PKC algorithms usually require complex calculations, and there is often a nonlinear relationship between the secret information and the corresponding waveform. However, almost all SPA methods involving dimensionality reduction tend to use linear dimensionality reduction algorithms, which cannot maintain the global and local structures between high-dimensional waveform segments, making it difficult to accurately recover the algorithm key. Summary of the invention

[0005] In view of this, an embodiment of the present application at least provides a cryptographic algorithm side channel analysis method based on manifold learning, comprising the following steps: Step 1: Collect energy information of the equipment running the cryptographic algorithm, analyze the energy trace, locate the key operation position related to the key, and divide it into several operation segments; Step 2: Apply the manifold learning algorithm to extract features from the operation segments and map the operation segments in the high-dimensional waveform space to the low-dimensional feature space; Step 3: Use clustering algorithm to classify feature points and restore key operation types based on the classification results; Step 4: Combine the algorithm principles and complete key recovery according to the key operation type.

[0006] According to one aspect of the embodiment of the present disclosure, the CRT-RSA in step 1 decomposes a modular exponentiation operation of RSA into two modular exponentiation operations, thereby reducing the time complexity of RSA. If the attacker can obtain the exponents of the two modular exponentiation operations, the private key can be derived. Therefore, this part of the energy waveform is selected as the analysis target. One segment is a cryptographic operation. When the exponent bit is 0, a square operation is performed; when the exponent bit is 1, a square operation and a multiplication operation are performed. The square operation and the multiplication operation present different characteristics in the waveform. According to the characteristics, the complete operation sequence can be restored, and then the exponent can be derived. The modular exponentiation operation of the CRT-RSA algorithm repeatedly performs exponential calculations and performs sliding averaging on the energy waveform, which can cause several peaks to appear in the waveform. The key operations can be located based on the peaks and operation intervals, and the number of sampling points of the operation fragments is counted. The number of sampling points is set as the interception length, and each key operation is intercepted from the starting point according to this length to form a set of operation segments to be analyzed.

[0007] According to an example of an embodiment of the present disclosure, the CRT-RSA algorithm in step 3 involves two types of cryptographic operations, namely square operations and multiplication operations. The clustering algorithm can be used to classify the feature points extracted by UMAP. The hierarchical clustering method, as a connectivity-based clustering algorithm, has the ability to recognize hierarchical structures and form clusters at different granularity levels. It can analyze waveform data at different scales. Therefore, the classification effect can be obtained using hierarchical clustering.

[0008] According to an example of an embodiment of the present disclosure, in the step 4, an energy waveform is analyzed, and the classification accuracy of cryptographic operations is 99.73%. There are 2 operations that are classified incorrectly. For the incorrectly classified operations, it is necessary to traverse possible operation types and try to recover the key; if the current operation and the next operation type are both square, the exponent bit corresponding to the current operation is 0; if the current operation is square and the next operation is multiplication, the exponent bit corresponding to the current operation is 1; the PCA algorithm is used for dimensionality reduction, and the classification accuracy is 33.69%. 10 waveforms are required and a majority vote is performed to obtain the correct classification. In the case of single wave analysis, the use of manifold learning algorithm for dimensionality reduction can improve the accuracy by 66.04%. Under the same accuracy, the use of manifold learning algorithm can reduce the number of waveforms required to recover the key by 90%.

[0009] This application at least includes the following beneficial effects: 1. The present invention can perform feature extraction and clustering on the key-related operation segments of the cryptographic algorithm to obtain the operation sequence and realize efficient key recovery; 2. Compared with the linear dimensionality reduction algorithm PCA, the present invention reduces the false alarm rate of cryptographic operation classification by 30% when the same number of waveforms are collected, and reduces the number of waveforms required to restore cryptographic operations by 30% when the same accuracy is achieved; 3. First, collect the energy information of the equipment running the cryptographic algorithm, analyze the collected energy traces, locate the key operation position related to the key, and divide it into several operation segments; then, apply the manifold learning algorithm to extract the features of the operation segments, and map the operation segments in the high-dimensional waveform space to the low-dimensional feature space; finally, use the hierarchical clustering algorithm to classify the feature points, restore the key operation type according to the classification results, and finally obtain the key, thereby realizing the automated side channel analysis of the cryptographic algorithm.

[0010] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and other purposes, features and advantages of the embodiments of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0012] Figure 1 is a flow chart of the method of the present invention; Figure 2 It is the energy waveform of the key operation process of the method embodiment of the present invention; Figure 3 are energy waveform characteristics of different operations of the method embodiments of the present invention; Figure 4 It is a comparison of the dimensionality reduction results of the operation segments in the embodiments of the method of the present invention. DETAILED DESCRIPTION

[0013] The technical solutions in the embodiments of the present disclosure will be described clearly and completely below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0014] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme of the present application is further elaborated in detail below in conjunction with the accompanying drawings and embodiments. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the following description, it is related to "optional implementation method", which describes a subset of all possible embodiments, but it can be understood that the "optional implementation method" can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict. The term "first / second" involved is only to distinguish similar objects, and does not represent a specific order for the object. It can be understood that "first / second" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by technicians in the technical field of the present application. The terms used herein are only for the purpose of describing the present application and are not intended to limit the present application.

[0015] Taking the CRT-RSA algorithm as an example, the energy waveform of the CRT-RSA algorithm running on a commercial USB-Key is collected, and the method of the present invention is used to recover the key for the waveform set. The CRT-RSA algorithm is an implementation method for optimizing the classic RSA algorithm, which uses the Chinese remainder theorem to accelerate the RSA decryption process.

[0016] like Figure 1 As shown, a cryptographic algorithm side channel analysis method based on manifold learning includes the following steps: Step 1: Collect the energy waveform of the device running the CRT-RSA algorithm, locate the part of the waveform that performs two modular exponentiation operations, and find the area related to the leakage of secret information. Analyze the energy waveform of the modular exponentiation process and divide the waveform into several segments according to the characteristics.

[0017] Specifically, CRT-RSA decomposes a large modular exponentiation operation of RSA into two smaller modular exponentiation operations, reducing the time complexity of RSA. If the attacker can obtain the exponents of two modular exponentiation operations, the private key can be derived. Therefore, this part of the energy waveform is selected as the analysis target. The energy waveform of a modular exponentiation process is as follows: Figure 2 As shown in the figure, the enlarged part shows several regular segments, and one segment is a cryptographic operation. When the exponent bit is 0, a square operation is performed; when the exponent bit is 1, a square operation and a multiplication operation are performed. The square operation and the multiplication operation present different characteristics in the waveform. According to the characteristics, the complete operation sequence can be restored, and then the exponent can be derived.

[0018] The modular exponentiation operation of the CRT-RSA algorithm repeatedly performs exponential calculations and performs sliding averages on the energy waveform, which can cause several large peaks to appear in the waveform. The key operations can be located based on the peaks and operation intervals. The number of sampling points of the operation fragments is counted, and the maximum number of sampling points is set as the interception length. Each key operation is intercepted from the starting point according to this length to form a set of operation segments to be analyzed.

[0019] Step 2: Apply the manifold learning algorithm to reduce the dimension of the operation segment set, and represent the operation segment containing hundreds or even thousands of sampling points with a low-dimensional feature point.

[0020] Specifically, the energy waveform characteristics of different operations are as follows: Figure 3 As shown, "S" represents a square operation and "M" represents a multiplication operation. This embodiment uses the UMAP algorithm to reduce the dimension of the set of operation segments. In order to solve the problem that linear dimensionality reduction algorithms are difficult to retain the nonlinear structure between waveform data, the present invention proposes to use a manifold learning algorithm to extract features from waveform segments. This embodiment selects the UMAP algorithm for dimensionality reduction. UMAP is a machine learning technology that can reduce dimensionality in a nonlinear manner and has no computational restrictions on the embedding dimension. Waveform data provides different feature information at different time scales, and UMAP has the ability to retain multi-scale waveform data structure information, enabling it to extract local and global feature information. In this embodiment, the trace segments are reduced to 2 dimensions. In order to compare the effects of different dimensionality reduction algorithms on the performance of waveform feature extraction, the present invention uses PCA to extract features from waveform segments, and the dimensionality reduction results are compared. Figure 4 As shown in the figure. After UMAP dimensionality reduction, the intra-class aggregation of the feature points of the same type of operation is high, while the inter-class dispersion of the feature points of different types of operations is high. However, after PCA dimensionality reduction, the feature points of square operations and multiplication operations are mixed together, which is not conducive to the subsequent operation classification. It is necessary to combine multiple waveform analyses and use majority voting or weighting methods to finally recover the key.

[0021] Step 3: Use clustering algorithm to classify feature points and restore the operation sequence according to the clustering results.

[0022] Specifically, the CRT-RSA algorithm involves two types of cryptographic operations, namely square operations and multiplication operations. The feature points extracted by UMAP can be classified using a clustering algorithm. In this embodiment, the hierarchical clustering algorithm is selected to obtain the best performance. As a clustering algorithm based on connectivity, the hierarchical clustering method has the ability to identify hierarchical structures and form clusters at different granularity levels, and can effectively analyze waveform data at different scales. Therefore, the best classification effect can be obtained using hierarchical clustering.

[0023] Step 4: Combine the algorithm principles and complete key recovery according to the key operation type.

[0024] Specifically, in this embodiment, an energy waveform is analyzed, and the classification accuracy of cryptographic operations is 99.73%, with 2 operations classified incorrectly. For incorrectly classified operations, it is necessary to traverse possible operation types and try to recover the key. If the current operation and the next operation type are both square, the exponent bit corresponding to the current operation is 0; if the current operation is square and the next operation is multiplication, the exponent bit corresponding to the current operation is 1. If the PCA algorithm is used for dimensionality reduction, the classification accuracy is only 33.69%, and at least 10 waveforms must be used and a majority vote is required to obtain the correct classification. In the case of single-wave analysis, the use of a manifold learning algorithm for dimensionality reduction can improve the accuracy by 66.04%. Under the same accuracy conditions, the use of a manifold learning algorithm can reduce the number of waveforms required to recover the key by 90%.

[0025] It should be noted that the object information (including but not limited to the object's device information, corresponding personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the object or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0026] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0027] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. The above-mentioned embodiments only express several implementation methods of the present application, and their descriptions are relatively specific and detailed, but they cannot be understood as limiting the scope of the patent of this application. It should be pointed out that for ordinary technicians in this field, without departing from the concept of the present application, several deformations and improvements can be made, which all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be based on the attached claims.

Claims

1. A cryptographic algorithm side channel analysis method based on manifold learning, characterized in that: The platform includes: Step 1: Collect energy information of the equipment running the cryptographic algorithm, analyze the energy trace, locate the key operation position related to the key, and divide it into several operation segments; Collect the energy waveform of the device running the CRT-RSA algorithm, locate the part of the waveform that performs two modular exponentiation operations, and find the area related to the leakage of secret information; analyze the energy waveform of the modular exponentiation process, and divide the waveform into several segments according to the characteristics; Step 2: Apply the manifold learning algorithm to extract features from the operation segments and map the operation segments in the high-dimensional waveform space to the low-dimensional feature space; Apply the manifold learning algorithm to reduce the dimension of the operation segment set, and represent the operation segment containing several sampling points with a low-dimensional feature point; Step 3: Use clustering algorithm to classify feature points and restore key operation types based on the classification results; Step 4: Combine the algorithm principles and complete key recovery according to the key operation type.

2. The method for side channel analysis of cryptographic algorithms based on manifold learning according to claim 1, characterized in that: In step 1, CRT-RSA decomposes a modular exponentiation operation of RSA into two modular exponentiation operations, which reduces the time complexity of RSA. If the attacker can obtain the exponents of the two modular exponentiation operations, the private key can be derived. Therefore, this part of the energy waveform is selected as the analysis target. One segment is a cryptographic operation. When the exponent bit is 0, a square operation is performed; when the exponent bit is 1, a square operation and a multiplication operation are performed. The square operation and the multiplication operation present different characteristics in the waveform. According to the characteristics, the complete operation sequence can be restored, and then the exponent can be derived. The modular exponentiation operation of the CRT-RSA algorithm repeatedly performs exponential calculations and performs sliding averaging on the energy waveform, which can cause several peaks to appear in the waveform. The key operations can be located based on the peaks and operation intervals, and the number of sampling points of the operation fragments is counted. The number of sampling points is set as the interception length, and each key operation is intercepted from the starting point according to this length to form a set of operation segments to be analyzed.

3. The cryptographic algorithm side channel analysis method based on manifold learning according to claim 1, characterized in that: The CRT-RSA algorithm in step 3 involves two types of cryptographic operations, namely square operations and multiplication operations. The feature points extracted by UMAP can be classified using a clustering algorithm. The hierarchical clustering method, as a connectivity-based clustering algorithm, has the ability to identify hierarchical structures and form clusters at different granularity levels. It can analyze waveform data at different scales. Therefore, the use of hierarchical clustering can achieve classification effects.

4. The cryptographic algorithm side channel analysis method based on manifold learning according to claim 1, characterized in that: In the step 4, an energy waveform is analyzed, and the classification accuracy of cryptographic operations is 99.73%. There are 2 operations that are classified incorrectly. For the incorrectly classified operations, it is necessary to traverse the possible operation types and try to recover the key; if the current operation and the next operation type are both square, the exponent bit corresponding to the current operation is 0; if the current operation is square and the next operation is multiplication, the exponent bit corresponding to the current operation is 1; the PCA algorithm is used for dimensionality reduction, and the classification accuracy is 33.69%. 10 waveforms are required and a majority vote is performed to obtain the correct classification. In the case of single wave analysis, the use of manifold learning algorithm for dimensionality reduction can improve the accuracy by 66.04%. Under the same accuracy, the use of manifold learning algorithm can reduce the number of waveforms required to recover the key by 90%.

Images