High-precision side channel analysis method for high-order block cipher algorithm

Abstract

The invention relates to a high-precision side channel analysis method for a high-order block cipher algorithm, and belongs to the technical field of information security cipher. The method comprises the following steps: firstly, acquiring side information of block cipher algorithm equipment running high-order mask protection, and positioning an area for executing secret information related operation in the side information; and in combination with a block cipher algorithm principle, performing feature extraction and dimension reduction on side information by using a feature selection function. Matrix multiplication is applied to obtain multi-linear vectors, and feature integration of secret information and masks is carried out. Compared with a traditional deep learning side channel analysis method, the method does not need to obtain prior knowledge related to masks in advance, and has lower calculation complexity and higher success rate when the multi-linear convolutional neural network is used for analyzing the key search space of the block cipher. The number of energy traces required for successfully recovering the secret key is reduced by at least 30% compared with that of a common CNN method, and the false alarm rate is reduced by at least 30% compared with that of the CNN method under the same number of energy traces.

Description

Technical Field

[0001] The present disclosure relates to the field of secure cryptography technology, and more specifically, to a high-precision side channel analysis method for a high-order block cipher algorithm. Background Art

[0002] In modern cryptography, block ciphers, especially the Advanced Encryption Standard (AES), are widely used due to their high security and efficiency. However, with the development of side-channel attack technology, the security of the AES algorithm faces new threats. Side-channel attacks recover keys by analyzing non-traditional information such as energy and electromagnetic leakage during the execution of encryption algorithms, posing a severe challenge to the security of cryptographic systems.

[0003] In order to resist side channel attacks, masking technology was proposed and widely used in the AES algorithm. The core idea of ​​masking technology is to randomize the intermediate values ​​in the operation process and cut off the correlation between energy and sensitive information, thereby improving the algorithm's resistance to side channel attacks and providing new ideas for the hardware security design of cryptographic algorithms.

[0004] Although masking technology increases the difficulty of analysis for attackers, this method is still vulnerable to high-order energy analysis, which makes it possible to conduct side channel analysis. In order to improve security, researchers have proposed high-order masking schemes. These schemes are based on the idea of ​​secret sharing and split the secret information into multiple (n) shared factors. Each shared factor is calculated separately in its own channel. Only by detecting all channels at the same time can the complete secret information be recovered. This method can theoretically resist side channel attacks of order n and below, significantly improving the security of the AES algorithm.

[0005] In recent years, the application of artificial intelligence technology in side channel analysis has gradually increased. It can process and analyze a large amount of side channel data, identify patterns and features in the execution of encryption algorithms, and thus improve the efficiency and accuracy of side channel attacks. Deep learning models, such as convolutional neural networks (CNN) and recurrent neural networks (RNN), have been used to extract key information from side channel data, showing advantages that traditional cryptanalysis methods cannot match. However, deep learning technology is mostly used to process cryptographic algorithms with low-order mask protection. How to effectively combine deep learning and side channel analysis technology, and continuously update and optimize neural network models to adapt to new security requirements, is still an important research direction in the current cryptography and security fields. Summary of the invention

[0006] In view of this, the embodiments of the present application at least provide a high-precision side channel analysis method for high-order block cipher algorithms. The purpose of the present invention is to solve the problems of the lack of means for high-order mask attacks in the side channel field based on the shortcomings and defects of the prior art, and propose a high-precision side channel analysis method for high-order block cipher algorithms - Multilinear Convolutional Neural Network (M-CNN). The present invention can automatically analyze the side information protected by high-order masks, thereby recovering the algorithm key with extremely high accuracy and quantifying the minimum value of the required side information.

[0007] A high-precision side channel leakage quantification method for a high-order block cipher algorithm comprises the following steps:

[0008] Step 1: Collect side information (such as energy trace) of the device running the block cipher algorithm with high-order mask protection, and locate the area in the side information that performs operations related to the secret information.

[0009] Step 2: Based on the principle of block cipher algorithm, use feature selection function f to extract features and reduce dimension of side information.

[0010] Step 3: Apply matrix multiplication to obtain multilinear vectors for feature integration of secret information and mask.

[0011] Step 4: Use the classification function C to predict the key secret information.

[0012] Step 5: Use the intermediate value prediction result to calculate the block cipher algorithm key guessing entropy and complete key recovery.

[0013] According to one aspect of the embodiment of the present disclosure, in step 2, in combination with the principle of the AES algorithm, a feature selection function is first used to map the energy trace into a feature vector to extract features of the cryptographic operation intermediate value and the mask;

[0014] Observe the dimension of the feature vector, reduce the dimension of the high-dimensional feature vector, further shorten the feature length, and obtain the low-dimensional features of the intermediate values ​​and masks of the cryptographic operation.

[0015] According to an example of an embodiment of the present disclosure, in step 3, a matrix outer product operation is performed on low-dimensional feature vectors respectively containing cryptographic operation intermediate values ​​and masks to combine and generate a feature matrix;

[0016] The feature matrix is ​​reshaped into a one-dimensional vector with the same number of elements, and then combined with the remaining feature vectors by matrix outer product, and so on, to finally generate a multilinear vector and complete the feature integration of the intermediate values ​​and masks of the encryption operation.

[0017] This application at least includes the following beneficial effects:

[0018] 1. The invention can perform feature extraction and feature integration on the side information of the high-order mask-protected block cipher algorithm to obtain the intermediate value related to the key in the algorithm, thereby recovering the key. The invention does not need to obtain the mask-related prior knowledge in advance. Compared with the traditional deep learning side channel analysis method, the use of multilinear convolutional neural network in analyzing the key search space of the block cipher has lower computational complexity and higher success rate.

[0019] 2. The invention can reduce the number of energy traces required for successfully recovering the key by at least 30% compared with the ordinary CNN method, and reduce the false alarm rate by at least 30% compared with the CNN method with the same number of energy traces.

[0020] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The above and other purposes, features and advantages of the embodiments of the present disclosure will become more apparent by describing the embodiments of the present disclosure in more detail in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure and constitute a part of the specification. Together with the embodiments of the present disclosure, they are used to explain the present disclosure and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0022] Figure 1 Flowchart provided for the embodiment of the present application;

[0023] Figure 2 A schematic diagram of the energy trace of the encryption process performed by the algorithm provided in the embodiment of the present application;

[0024] Figure 3 A schematic diagram of leakage analysis results provided in an embodiment of the present application;

[0025] Figure 4 A schematic diagram of the basic architecture provided for the embodiments of the present application;

[0026] Figure 5 A schematic diagram of different key guessing entropy results provided in an embodiment of the present application;

[0027] Figure 6 A schematic diagram for comparing key recovery efficiency provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present disclosure will be described clearly and completely below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0029] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme of the present application is further elaborated in detail below in conjunction with the accompanying drawings and embodiments. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the following description, it is related to "optional implementation method", which describes a subset of all possible embodiments, but it can be understood that the "optional implementation method" can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict. The term "first / second" involved is only to distinguish similar objects, and does not represent a specific order for the object. It can be understood that "first / second" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by technicians in the technical field of the present application. The terms used herein are only for the purpose of describing the present application and are not intended to limit the present application.

[0030] The embodiment of the present application provides an AES algorithm with second-order mask protection as an example, which is simulated and implemented on an STC89C52RC development board and energy information is collected, and the method of the present invention is used to recover the key from the energy trace.

[0031] like Figure 1 As shown, a high-precision side channel leakage quantification method for a high-order block cipher algorithm comprises the following steps:

[0032] Step 1: Collect the energy signal of the AES algorithm device running the second-order mask protection, locate the part of the energy side information that performs the Sub Bytes nonlinear substitution transformation (S-box) operation, and find the area related to the leakage of secret information.

[0033] Specifically, the AES algorithm encryption process involves secret information such as encryption keys and mask values, which may cause energy leakage. In particular, the S-box operation in the first round of the encryption algorithm is extremely vulnerable to side channel attacks, thereby recovering the intermediate value of the encryption operation and finally calculating the key. Therefore, this part of the energy trace is selected as the analysis target.

[0034] The energy trace of the AES128 algorithm with second-order mask protection is as follows: Figure 2 As shown, in order to better obtain the leakage information, the leakage of multiple shared factors in the entire S-box operation of the first round of encryption operation is simulated by assembly instructions (such as MOVE), replacing the complete mask protection AES implementation.

[0035] During each encryption process, the mask remains unchanged; in different encryption processes, the mask takes random values. The energy traces are collected by a PicoScope 3403D oscilloscope with a sampling rate of 250MS / s. A total of 100,000 energy traces are collected, each of which contains 16 S-box operations and different mask operations in the first round of encryption operations; in the specific implementation of the microcontroller, the operation process of the S-box and the mask will generate side information with different characteristics, and the intermediate value of the encryption operation can be restored based on the side information.

[0036] In this embodiment, the energy trace is analyzed for points of interest to locate the area where the S-box output value and the two masks are leaked. The results are as follows: Figure 3 shown.

[0037] Step 2: Based on the principle of block cipher algorithm, use feature selection function f to extract features and reduce dimension of side information.

[0038] Specifically, during the hardware implementation of the AES algorithm, the Hamming weight leakage of the mask m and the masked intermediate value v' can be seen in the energy trace.

[0039] In particular, the second-order Boolean mask can be expressed as: v = Sbox(p⊕k) = v'⊕m1⊕m2, where m1 and m2 are two mask values, and v' is the masked middle value; v, m1, and m2 are respectively at different times t in the energy trace. 1， t2 and t3 generate leakages L(t1), L(t2), and L(t3). By analyzing their leakages, we can obtain relevant information about the intermediate value v'.

[0040] The main structure of the present invention is as follows Figure 4 As shown, the feature selection function f maps the energy trace X into a feature vector of size n×1 To extract L(t i ), where

[0041] In this embodiment, the feature selection function is composed of the convolution layer and the pooling layer of CNN. Since the design principle of M-CNN is to obtain L(t i ), otherwise the high-dimensional multilinear vector makes subsequent analysis impractical. To this end, a fully connected layer with a small number of neurons is added after the convolution block to complete the dimensionality reduction and further shorten the feature length.

[0042] Step 3: Apply matrix multiplication to obtain multilinear vectors for feature integration of secret information and mask.

[0043] Specifically, the multilinear vector can be expressed as

[0044] , the process first combines the eigenvector f1(X) with f i (X) T Perform matrix outer product combination to generate feature matrix. Function M reshapes the feature matrix of size n×n into a matrix of size n. 2 ×1 vector, which then continues to be i+1 (X) T Perform matrix outer product combination, and so on, to complete the feature integration of the encryption operation intermediate value and mask, and the size of the final multilinear vector v is n d ×1.

[0045] Step 4: Use the classification function C to predict the key secret information.

[0046] Specifically, in this embodiment, the classification function C is composed of a fully connected layer, and the input is a multi-linear vector v. The function predicts the encryption operation intermediate value v' and outputs y=C(v).

[0047] Step 5: Use the intermediate value prediction result to calculate the block cipher algorithm key guessing entropy and complete key recovery.

[0048] Specifically, in this embodiment, based on the prediction result of the S-box output value v', the guess entropy of all possible keys is calculated in combination with the known plaintext, and the correct recovery result of the first byte key is finally achieved by observing the key ranking. Figure 5 As shown, the red curve is the entropy of the correct key guess.

[0049] Compared with the traditional deep learning side channel analysis method, the present invention uses a multilinear convolutional neural network to analyze the key search space of a block cipher, which has lower computational complexity and higher success rate.

[0050] The number of energy traces required for successfully recovering the key by the present invention is reduced by 43 compared with the common CNN method, and the proportion of required energy traces is reduced by 36.13%. Figure 6 In 100 attack experiments, the key recovery success rate of the present invention is 100%, which is significantly improved compared with the CNN method with the same number of energy traces, and the false alarm rate is reduced by at least 30%.

[0051] It should be noted that the object information (including but not limited to the object's device information, corresponding personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the object or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0052] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. The above-mentioned embodiments only express several implementation methods of the present application, and their descriptions are relatively specific and detailed, but they cannot be understood as limiting the scope of the patent of this application. It should be pointed out that for ordinary technicians in this field, without departing from the concept of the present application, several deformations and improvements can be made, which all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be based on the attached claims.

Claims

1. A high-precision side channel analysis method for high-order block cipher algorithms, characterized in that: The following steps are involved: Step 1: Collect side information of the device running the block cipher algorithm with high-order mask protection, and locate the area in the side information that performs operations related to the secret information; Step 2: Combined with the principle of block cipher algorithm, feature selection function is used to extract features and reduce the dimension of the side information; Step 3: Apply matrix multiplication to obtain multilinear vectors and perform feature integration of secret information and mask; Step 4: Use the classification function to predict the key secret information; Step 5: Use the intermediate value prediction result to calculate the block cipher algorithm key guessing entropy and complete key recovery.

2. A high-precision side channel analysis method for a high-order block cipher algorithm as claimed in claim 1, characterized in that: In step 2, in combination with the principle of the AES algorithm, a feature selection function is first used to map the energy trace into a feature vector to extract the features of the cryptographic operation intermediate value and the mask; Observe the dimension of the feature vector, reduce the dimension of the high-dimensional feature vector, further shorten the feature length, and obtain the low-dimensional features of the intermediate values ​​and masks of the cryptographic operation.

3. A high-precision side channel analysis method for a high-order block cipher algorithm as claimed in claim 1, characterized in that: In step 3, a matrix outer product operation is performed on the low-dimensional feature vectors respectively containing the intermediate value of the cryptographic operation and the mask, and a feature matrix is ​​generated by combining them; The feature matrix is ​​reshaped into a one-dimensional vector with the same number of elements, and then the matrix outer product is performed with the remaining feature vectors, and so on, to finally generate a multilinear vector and complete the feature integration of the intermediate values ​​and masks of the encryption operation.

Images