Side channel analysis method based on firmware instrumentation

Abstract

The invention is suitable for the technical field of software testing, and particularly relates to a side channel analysis method based on firmware instrumentation, and the method comprises the steps: obtaining an execution stream in a firmware image of target equipment; according to the execution stream in the firmware image of the target equipment, instrumentation parameters used for monitoring side channel signals in the execution process of the target equipment are determined, and the instrumentation parameters are rapidly analyzed and positioned; according to the instrumentation parameters, side channel signal monitoring is executed through firmware instrumentation, side channel data corresponding to each monitoring point and the current operation state corresponding to target equipment at each monitoring point are obtained, and instrumentation heavy load and key operation monitoring is achieved; determining target side channel analysis data of the target equipment according to the side channel data corresponding to each monitoring point and the current operation state corresponding to the target equipment at each monitoring point; and finally, according to the target side channel analysis data of the target equipment, a side channel analysis result of the target equipment is determined, so that the evaluation data quality is improved, and accurate depth monitoring and result analysis are realized.

Description

Technical Field

[0001] The present application belongs to the field of software testing technology, and in particular, relates to a side channel analysis method based on firmware instrumentation. Background Art

[0002] Side Channel Analysis (SCA) is a technique for inferring encryption keys or sensitive data by analyzing non-communication data (so-called "side channel" information) generated by encryption devices when executing encryption algorithms. These non-communication data include but are not limited to power consumption, electromagnetic radiation, running time, acoustic noise, and microarchitecture events (such as cache access). Side channel analysis exploits the intersection of the physical world and the digital world to infer secret information in the encryption process through physical phenomena.

[0003] Traditional side-channel analysis methods often rely on static analysis of firmware code, but this method often cannot fully reflect the dynamic behavior at runtime. There is a lack of systematic and automated side-channel analysis tools, and there is no effective way to select the most informative monitoring points, resulting in too much or too little data collected, low data quality, and inaccurate analysis results. Summary of the invention

[0004] The embodiment of the present application provides a side channel analysis method based on firmware instrumentation, which can solve the problem of low data quality and inaccurate analysis results due to the lack of systematic and automated side channel analysis tools during the side channel analysis process.

[0005] In a first aspect, an embodiment of the present application provides a side channel analysis method based on firmware instrumentation, comprising:

[0006] Get the execution flow in the firmware image of the target device;

[0007] Determining, according to the execution flow in the firmware image of the target device, instrumentation parameters for monitoring side channel signals during the execution of the target device; wherein the instrumentation parameters include at least three monitoring points for data collection;

[0008] Performing side channel signal monitoring through firmware instrumentation according to the instrumentation parameters to obtain side channel data corresponding to each monitoring point and a current operating state corresponding to the target device at each monitoring point;

[0009] Determining target side channel analysis data of the target device according to the side channel data corresponding to each of the monitoring points and the current operation state corresponding to the target device at each of the monitoring points;

[0010] A side channel analysis result of the target device is determined based on the target side channel analysis data of the target device.

[0011] The above technical solutions in the embodiments of the present application have at least the following technical effects:

[0012] The side channel analysis method based on firmware plug-in provided in the embodiment of the present application obtains the basic basis for plug-in monitoring by acquiring the execution flow in the firmware image of the target device. According to the execution flow in the firmware image of the target device, the plug-in parameters for monitoring the side channel signal during the execution of the target device are determined, and the plug-in parameters are quickly analyzed and located. According to the plug-in parameters, the side channel signal monitoring is performed by firmware plug-in, and the side channel data corresponding to each monitoring point and the current operating state corresponding to the target device at each monitoring point are obtained, so as to realize plug-in overload and key operation monitoring. According to the side channel data corresponding to each monitoring point and the current operating state corresponding to the target device at each monitoring point, the target side channel analysis data of the target device is determined, which enhances the pertinence and practicality of the analysis. Finally, according to the target side channel analysis data of the target device, the side channel analysis result of the target device is determined, the quality of the evaluation data is improved, and accurate in-depth monitoring and result analysis are realized.

[0013] In a second aspect, an embodiment of the present application provides a side channel analysis device based on firmware instrumentation, including:

[0014] An acquisition unit, used for acquiring an execution flow in a firmware image of a target device;

[0015] A parameter unit, configured to determine, according to the execution flow in the firmware image of the target device, an instrumentation parameter for monitoring a side channel signal during execution of the target device; wherein the instrumentation parameter includes at least three monitoring points for data collection;

[0016] A monitoring unit, configured to perform side channel signal monitoring through firmware instrumentation according to the instrumentation parameters, to obtain side channel data corresponding to each of the monitoring points and a current operating state corresponding to the target device at each of the monitoring points;

[0017] a data unit, configured to determine target side channel analysis data of the target device according to the side channel data corresponding to each of the monitoring points and the current operation state corresponding to the target device at each of the monitoring points;

[0018] A result unit is used to determine a side channel analysis result of the target device according to the target side channel analysis data of the target device.

[0019] In a third aspect, an embodiment of the present application provides a side-channel analysis device based on firmware instrumentation, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements a method as described in any one of the first aspects above when executing the computer program.

[0020] In a fourth aspect, an embodiment of the present application provides a computer program product. When the computer program product runs on a side-channel analysis device based on firmware instrumentation, the side-channel analysis device based on firmware instrumentation executes the method of any one of the above aspects.

[0021] It can be understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant descriptions in the above aspects and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0023] Figure 1 It is a flowchart of a side channel analysis method based on firmware instrumentation provided by an embodiment of the present application;

[0024] Figure 2 It is a flowchart of step S200 in the side channel analysis method based on firmware instrumentation provided in an embodiment of the present application;

[0025] Figure 3 It is a flowchart of step S230 of the side channel analysis method based on firmware instrumentation provided by an embodiment of the present application;

[0026] Figure 4 It is a flowchart of step S232 of the side channel analysis method based on firmware instrumentation provided by an embodiment of the present application;

[0027] Figure 5 It is a flowchart of step S400 of a side channel analysis method based on firmware instrumentation provided by an embodiment of the present application;

[0028] Figure 6 It is a flowchart of step S440 of the side channel analysis method based on firmware instrumentation provided by an embodiment of the present application;

[0029] Figure 7 It is a flowchart of step S500 of a side channel analysis method based on firmware instrumentation provided by an embodiment of the present application;

[0030] Figure 8 It is a flowchart of step S520 of the side channel analysis method based on firmware instrumentation provided by an embodiment of the present application;

[0031] Fig. 9 It is a structural schematic diagram of a side channel analysis device based on firmware instrumentation provided by an embodiment of the present application;

[0032] Fig.10 It is a structural diagram of a side channel analysis device based on firmware instrumentation provided in one embodiment of the present application. DETAILED DESCRIPTION

[0033] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0034] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0035] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0036] As used in the specification of this application and the appended claims, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting" depending on the context. Similarly, the phrase "if it is determined" or "if the described condition or event is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce the described condition or event is detected" or "in response to detecting the described condition or event" depending on the context.

[0037] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0038] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0039] Traditional side-channel analysis methods often rely on static analysis of firmware code, but this method often cannot fully reflect the dynamic behavior at runtime. There is a lack of systematic and automated side-channel analysis tools, and there is no effective way to select the most informative monitoring points, resulting in too much or too little data collected, low data quality, and inaccurate analysis results.

[0040] To solve the above problems, an embodiment of the present application provides a side channel analysis method based on firmware plug-in. In this method, by obtaining the execution flow in the firmware image of the target device, the basic basis for plug-in monitoring is obtained. According to the execution flow in the firmware image of the target device, the plug-in parameters for monitoring the side channel signal during the execution of the target device are determined, and the plug-in parameters are quickly analyzed and located. According to the plug-in parameters, the side channel signal monitoring is performed by firmware plug-in, and the side channel data corresponding to each monitoring point and the current operating state corresponding to the target device at each monitoring point are obtained, so as to realize plug-in overload and key operation monitoring. According to the side channel data corresponding to each monitoring point and the current operating state corresponding to the target device at each monitoring point, the target side channel analysis data of the target device is determined, which enhances the pertinence and practicality of the analysis. Finally, according to the target side channel analysis data of the target device, the side channel analysis result of the target device is determined, the quality of the evaluation data is improved, and accurate in-depth monitoring and result analysis are realized.

[0041] The firmware instrumentation-based side-channel analysis method provided in the embodiment of the present application can be applied to a firmware instrumentation-based side-channel analysis device. In this case, the firmware instrumentation-based side-channel analysis device is the execution subject of the firmware instrumentation-based side-channel analysis method provided in the embodiment of the present application. The embodiment of the present application does not impose any restrictions on the specific type of the firmware instrumentation-based side-channel analysis device.

[0042] For example, a firmware instrumentation-based side-channel analysis device may be a mobile detection unit, a cloud-connected analysis device, a highly integrated portable detection toolkit, a desktop computer, a handheld device with wireless communication capabilities, a computing device, a computer, a laptop, etc.

[0043] In order to better understand the side channel analysis method based on firmware instrumentation provided in the embodiment of the present application, the specific implementation process of the side channel analysis method based on firmware instrumentation provided in the embodiment of the present application is exemplarily introduced below.

[0044] Figure 1 A schematic flow chart of a side channel analysis method based on firmware instrumentation provided in an embodiment of the present application is shown. The side channel analysis method based on firmware instrumentation includes:

[0045] S100, obtaining an execution flow in a firmware image of a target device.

[0046] It can be understood that the firmware image is a collection of all instructions and data required for the target device to run, usually a binary file provided by the device manufacturer. These files include the device operating system, drivers, applications, and other necessary codes. The execution flow refers to the actual execution order of these instructions in the device, which is the specific embodiment of each operation step of the device during operation. It can be obtained through reverse engineering or accepting input. The execution path in the firmware image can be parsed, that is, the code execution order of the device during operation, which helps to understand the internal working principle of the device and provide a basis for the subsequent selection of monitoring points. The purpose of obtaining the execution flow is to understand the specific operations of each step of the device during operation, as well as the relationship and order between these operations, which is very important for the subsequent side channel signal monitoring and analysis. Only by understanding the execution flow of the device can we determine where to insert monitoring points and collect useful side channel data.

[0047] S200, determining, according to an execution flow in a firmware image of a target device, an instrumentation parameter for monitoring a side channel signal during execution of the target device; wherein the instrumentation parameter includes at least three monitoring points for data collection.

[0048] It can be understood that the execution flow information of the firmware image can be used to determine the instrumentation parameters required to monitor the side channel signals. Instrumentation refers to inserting additional code or monitoring points during the execution of the device to collect data or monitor the status of the device. The instrumentation parameters include key information such as the location and number of monitoring points, and the instrumentation parameter information will be used for data collection during the execution of the device. Side channel signals refer to indirect output signals generated by the device during the execution process, such as power consumption, electromagnetic radiation, etc. The execution flow and sensitive field features in the firmware image of the target device can be scanned, for example, through encryption and decryption algorithm functions, passing parameters, etc., to locate the location and type of instrumentation parameters that need to be instrumented, such as giving an indication signal before and after the encryption and decryption algorithm operation. Through instrumentation, these side channel signals can be collected during the execution of the device, so as to monitor the operating status of the device and identify potential risks or failures.

[0049] In one possible implementation, see Figure 2 S200, determining, according to the execution flow in the firmware image of the target device, an instrumentation parameter for monitoring a side channel signal during the execution of the target device, including:

[0050] S210, according to the execution flow in the firmware image of the target device, each execution module in the firmware image and the instruction set on the execution module are parsed according to the preset parsing rules to obtain the execution node of each execution module in the firmware image.

[0051] It can be understood that the execution flow in the firmware image of the target device can be parsed in detail. According to the preset parsing rules, each execution module and its instruction set in the firmware image are parsed and processed. The execution module can be regarded as a functional unit in the firmware, and each module is responsible for a specific operation. By parsing these modules and their instruction sets, the execution node of each module can be determined. The execution node refers to the specific position and state of the execution module during the execution process, and they identify the key steps and instructions in the module. The purpose of parsing the execution node is to better understand the working mechanism of the firmware, so as to insert monitoring points at appropriate locations for effective side channel signal monitoring.

[0052] Exemplarily, the firmware image can be parsed by a static analysis algorithm or a dynamic analysis algorithm. Static analysis is a technique for analyzing code without actually running the program. It mainly parses the execution module and its instruction set by building a syntax tree (AST) and generating a control flow graph (CFG). A lexical analyzer and a syntax analyzer can be used in advance to generate AST, wherein the lexical analyzer decomposes the source code into a series of tokens, and the syntax analyzer builds a tree structure reflecting the source code structure based on these tokens. For example, an LL (k) or LR (k) syntax analysis algorithm can be used to generate AST. Based on AST, CFG is generated, and the control flow relationship between code blocks is visualized by analyzing the branch and loop structure in the code, and the key execution nodes are located. Dynamic analysis requires running the target program and obtaining more detailed execution information by tracking the execution path of the program. By simulating the execution of the program and treating the input as a symbolic variable, the dynamic analysis tool can explore different paths of the program and identify potential execution nodes, especially at branches and conditional judgments. By sending random or mutated data inputs to the program and determining the behavior changes of the program, execution nodes that may cause abnormal or undefined behavior can be found.

[0053] S220, scanning the execution node of each execution module in the firmware image, and obtaining the module identification and first position information of the execution node of the execution module; wherein the first position information includes the execution position information of the execution node of the execution module on the instruction set.

[0054] It can be understood that the module identifier is a mark used to uniquely identify each execution module, usually the name or address of the module. The first location information includes the specific location of the execution node on the instruction set, such as the address or offset of the instruction in the memory. By obtaining this information, the specific location and order of each execution module during the execution process can be understood. This is very important for subsequent side channel signal monitoring, because only by clarifying the location of the execution node can the monitoring point be inserted at the appropriate location to ensure that the monitored side channel signal is sufficiently representative and accurate.

[0055] Exemplarily, a suitable binary analysis tool, such as IDA Pro, Ghidra or Binary Ninja, etc., can be selected to track the control flow of each execution module and determine the entry point of each execution node. The instruction set of each execution module can be analyzed by disassembling the firmware image, the instruction sequence constituting the execution node can be identified, and the module identification can be extracted from the disassembly result, which can be the name, address or other unique identifier of the module. The exact position of each execution node in the instruction set can be recorded, which can include the absolute address of the execution node corresponding instruction in the memory, the relative offset relative to the execution module start address, the sequential number in the instruction set, etc., for quick positioning. An index table or database can be created to store the module identification and first position information of each execution node.

[0056] S230: Determine, according to the module identifier of the execution node of the execution module and the first location information, an instrumentation parameter for monitoring a side channel signal during the execution process of the target device.

[0057] It can be understood that the plugging parameters for monitoring the side channel signals during the execution process of the target device are determined based on the module identification and the first position information of the execution node of the execution module obtained previously. These parameters include the location and number of monitoring points, which are the key to data collection and signal monitoring during the operation of the target device. By analyzing the module identification and location information of the execution node, it can be determined at which positions it is most appropriate to insert the monitoring points, so as to maximize the capture of side channel signals during the operation of the device. The purpose of this step is to provide accurate parameters for subsequent plugging operations to ensure the effectiveness and accuracy of side channel signal monitoring.

[0058] Optionally, see Figure 3 S230, determining, according to the module identifier of the execution node of the execution module and the first location information, an instrumentation parameter for monitoring the side channel signal during the execution process of the target device, including:

[0059] S231, dynamically grouping the target device execution process according to the module identifier of the execution node of the execution module and the first location information.

[0060] It can be understood that dynamic grouping refers to dividing into different monitoring groups according to the actual situation during the execution of the device according to the module identification. Each monitoring group contains several execution nodes, which have certain correlations during the execution process. Through dynamic grouping, the monitoring and analysis of side channel signals can be more effective. The purpose of grouping is to determine appropriate monitoring points within each group to ensure that the monitored signals are representative and can cover the key steps and states during the operation of the device.

[0061] Exemplarily, in step S231, dynamically grouping the target device execution process according to the module identifier of the execution node of the execution module includes:

[0062] S2311, determining at least one monitoring group of the execution process of the target device according to the module identifier of the execution node of the execution module; wherein the monitoring group is used to monitor the execution module of the target device.

[0063] It can be understood that the monitoring group is a logical grouping of execution modules for monitoring the target device, and each monitoring group contains one or more execution modules. These modules have certain correlations and similarities during the operation of the device. By grouping them with identified module identifiers, side channel signals can be monitored more systematically. The purpose of determining the monitoring group is to insert monitoring points in a targeted manner during the execution of the device to ensure that effective side channel data can be collected, and then the operating status of the device can be accurately monitored and analyzed. For example, according to different module identifiers, it is divided into monitoring groups for different modules such as network communication, data storage, and computing tasks.

[0064] Exemplarily, in step S231, dynamically grouping the target device execution process according to the first location information of the execution node of the execution module includes:

[0065] S2312: Determine three monitoring positions of each monitoring group of the target device execution process according to the first position information of the execution node of the execution module.

[0066] It can be understood that the starting monitoring position, running detection position, and termination detection position are determined for each monitoring group based on the position information of the execution node on the instruction set. The three monitoring positions of each monitoring group are the specific positions where the plug-in code is inserted. By monitoring these points, the side channel signals reflecting the execution process of the device can be collected. The monitoring position is the insertion point of the monitored plug-in. Insertion refers to the insertion of additional instructions or code snippets into the code to capture and record runtime information. Static code analysis tools (such as IDA Pro, Ghidra) can be used to reverse engineer the firmware to identify function entries, exits, loop structures, conditional branches, etc., and determine the monitoring position. The determination of dynamic grouping and monitoring positions is to ensure that the selection of monitoring points is scientific and representative, and can cover the key nodes and states during the operation of the device, thereby providing reliable data support for subsequent signal analysis.

[0067] S232 , determining, according to a result of dynamically grouping the target device execution process, an instrumentation parameter for monitoring a side channel signal during the target device execution process.

[0068] It can be understood that the instrumentation parameters include the location and number of monitoring points, which will be used to monitor side channel signals during the execution of the device. Through dynamic grouping, the key nodes and states of the device execution process can be clarified, so that the instrumentation code can be inserted at the monitoring location to ensure that effective side channel data can be collected. The determination of the instrumentation parameters is the basis for subsequent actual monitoring operations, ensuring that the monitoring process is targeted and effective.

[0069] Optionally, see Figure 4 S232, determining, based on the result of dynamically grouping the target device execution process, an instrumentation parameter for monitoring a side channel signal during the target device execution process, including:

[0070] S2321, according to the result of dynamically grouping the target device execution process, determine the monitoring position of each monitoring group as a monitoring point, and obtain at least three monitoring points for monitoring the side channel signal during the target device execution process.

[0071] It can be understood that, based on the results of dynamic grouping of the target device execution process, each monitoring position of each monitoring group is determined as a monitoring point, and the preset plug-in code is injected into the monitoring point. These monitoring points will be used to collect data on side channel signals during the execution of the device. The setting of at least three monitoring points is to ensure that enough data can be collected to reflect the different states and changes in the execution process of the device. By determining the monitoring position as a monitoring point, data collection can be carried out in a targeted manner to ensure that the monitored signals are representative and cover the key steps and states in the operation of the device, providing reliable data support for subsequent signal analysis.

[0072] S2322: Determine, according to all monitoring points for monitoring the side channel signal during the execution of the target device, an instrumentation parameter for monitoring the side channel signal during the execution of the target device.

[0073] It can be understood that the instrumentation parameters will be used to perform actual monitoring operations during the execution of the device. The instrumentation parameters include the location and number of monitoring points and the specific content of the monitoring. The instrumentation is determined by the location of all monitoring points to ensure that effective side channel signal data can be collected. The determination of instrumentation parameters is the basis for actual data collection, ensuring that the monitoring process is scientific and reasonable, and can reflect the actual situation during the operation of the device, providing reliable data support for subsequent signal analysis and device evaluation.

[0074] S300, performing side channel signal monitoring through firmware instrumentation according to instrumentation parameters, obtaining side channel data corresponding to each monitoring point and a current operating state corresponding to the target device at each monitoring point.

[0075] It can be understood that the monitoring of side channel signals can be performed through the monitoring points inserted in the firmware of the target device. Insertion refers to inserting additional code or instructions at a specific location in the firmware to collect side channel signal data during the operation of the device. The firmware code can be inserted in the firmware and reloaded into the target device to perform key encryption and decryption operations and perform side channel signal monitoring. Through the insertion code, the corresponding side channel data can be obtained at each monitoring point, as well as the current operating state of the target device at these monitoring points. The side channel data includes information such as power consumption and electromagnetic radiation during the execution of the device, which can reflect the operating state and performance of the device. The current operating state monitored is the specific situation of the device when performing a specific operation, such as the type and location of the executed instruction. The signal data is packaged with the operating state information for subsequent analysis. A cache can be set on the device to periodically upload the data to the backend server or directly transmit the data to the remote server or cloud platform in real time. The data at the monitoring point will be used for subsequent signal analysis to help identify the operating characteristics and potential risks of the device.

[0076] S400, determining target side channel analysis data of the target device according to the side channel data corresponding to each monitoring point and the current operation state corresponding to the target device at each monitoring point.

[0077] It can be understood that side channel data includes various indirect output signals generated by the device during execution, such as power consumption, electromagnetic radiation, etc., which can indirectly reflect the operating status and performance of the device. The current operating status refers to the status of the device during a specific operation, such as the type and location of the instruction being executed. By combining the side channel data and the operating status, a comprehensive analysis of the device's operation can be performed to determine the target side channel analysis data of the target device. The target side channel analysis data is the target analysis data selected from all side channel data. The target side channel analysis data will be used to identify the operating characteristics of the device, evaluate the performance and reliability of the device, and help discover potential risks or failures.

[0078] In one possible implementation, see Figure 5 S400, determining target side channel analysis data of the target device according to the side channel data corresponding to each monitoring point and the current operation state corresponding to the target device at each monitoring point, including:

[0079] S410 , determining, for each monitoring point, a total operation duration and an instantaneous power level corresponding to each monitoring point according to side channel data corresponding to each monitoring point and a current operation state corresponding to a target device at each monitoring point.

[0080] It can be understood that the total operation duration corresponding to the monitoring point refers to the total length of time the device performs an operation at a certain monitoring point, which can reflect the efficiency and stability of the device's execution process. The instantaneous power level refers to the power consumption of the device at a certain moment. By monitoring the instantaneous power, the energy consumption of the device when performing different operations can be understood. The total operation duration and instantaneous power level data corresponding to each monitoring point are data that can be directly obtained in the monitoring data. By combining the total operation duration and instantaneous power level, the operation of the device can be comprehensively analyzed to evaluate the performance and energy consumption characteristics of the device. These data will provide a basis for subsequent signal analysis and help identify the operating characteristics and potential problems of the device.

[0081] S420, based on the total operation duration corresponding to each monitoring point, calculate the ratio of the total operation duration of each monitoring point to the current operation state, and obtain the execution efficiency data corresponding to each monitoring point.

[0082] It can be understood that the total operation duration reflects the total length of time the device performs an operation at a certain monitoring point, while the current operation status reflects the specific situation of the device when performing a specific operation. The ratio of the two can be calculated by the preset quotient algorithm, and the execution efficiency of the device under different operation states can be evaluated. Execution efficiency data is an important indicator of device performance, which can reflect whether there are bottlenecks or inefficiencies in the execution process of the device. By analyzing the execution efficiency data, potential problems in the operation of the device can be discovered, the execution process of the device can be optimized, and the overall performance can be improved.

[0083] S430, determining power-time analysis data corresponding to each monitoring point according to the execution efficiency data, instantaneous power level and total operation duration corresponding to each monitoring point.

[0084] It can be understood that the execution efficiency data reflects the execution efficiency of the device under different operating conditions, the instantaneous power level reflects the energy consumption of the device at different operating moments, and the total operation duration is the total duration of the device's execution operation. These data can be analyzed in the form of preset function fitting, and the function fitting form of the power-time analysis data of each monitoring point can be obtained according to the execution efficiency data, instantaneous power level and total operation duration corresponding to each monitoring point. The power-time analysis data in the form of a curve can also be obtained according to the execution efficiency data, instantaneous power level and total operation duration corresponding to each monitoring point in the form of preset chart visualization. The power-time analysis data refers to the relationship between the energy consumption and time of the device under different operating conditions. Through these data, the energy consumption characteristics and performance of the device can be evaluated. The power-time analysis data provides a basis for a comprehensive evaluation of the operating status of the equipment and helps identify the energy consumption bottlenecks and optimization opportunities of the equipment.

[0085] S440, screening the power time analysis data corresponding to all monitoring points according to the power time analysis data corresponding to each monitoring point, and determining the target side channel analysis data of the target device.

[0086] It can be understood that the power-time analysis data of all monitoring points are screened to determine the target side channel analysis data of the target device. The power-time analysis data reflects the energy consumption and execution time of the device under different operating states. By screening these data, the most representative and critical monitoring points in the device operation process can be identified. The screening process can include sorting the data, screening outliers, identifying critical operating states, etc. Through screening, it can be determined which monitoring points' data are most important for the device's operating characteristics and performance evaluation, thereby obtaining the target side channel analysis data of the target device. These analysis data will be used for subsequent device performance evaluation and optimization to help identify the device's operating bottlenecks and potential problems.

[0087] Optionally, see Figure 6S440, based on the power time analysis data corresponding to each monitoring point, the power time analysis data corresponding to all monitoring points are screened to determine the target side channel analysis data of the target device, including:

[0088] S441, obtaining historical data of target devices of the same type; wherein the historical data of target devices of the same type include power time analysis data corresponding to the devices of the same type as the target device obtained by analyzing the devices of the same type as the target device after performing instrumentation monitoring.

[0089] It can be understood that the historical data of similar target devices can be extracted from various data sources using automated tools or manually. The data sources can be internal databases, industry sharing platforms, public data sets released by scientific research institutions, etc. The power consumption and time series characteristics of the devices in different operating states (such as power on, standby, executing specific tasks, etc.) are extracted from the historical data of similar target devices, and converted into the same data format as the time power consumption analysis data of the target device. The historical data of similar target devices includes the power time analysis data obtained by analyzing the same type of devices as the target device after performing plug-in monitoring. The historical data of similar target devices provides a reference benchmark that can be used to compare and evaluate the operation of the target device. By analyzing the power time analysis data of similar devices, the energy consumption and execution time characteristics of these devices in different operating states can be understood. These historical data provide a reference standard for the performance evaluation of the target device. By comparing with the historical data, suitable data can be accurately screened out as target data, thereby obtaining the target side channel analysis data of the target device.

[0090] S442, determining the data similarity between the power time analysis data corresponding to each monitoring point and the historical data of the same type of target device based on the power time analysis data corresponding to each monitoring point and the historical data of the same type of target device.

[0091] It can be understood that similarity analysis evaluates the operation of the target device by comparing the power-time data of the target device with that of similar devices under the same or similar operating conditions. The higher the similarity, the more likely it is that the target device's operating status is similar to that of similar devices and the operation is normal; the lower the similarity, the more likely it is that there are abnormalities or potential problems. The data similarity between the power-time analysis data corresponding to each monitoring point and the historical data of similar target devices can be determined by calculating the Euclidean distance. The Euclidean distance is applicable to the similarity measurement of one-dimensional or multi-dimensional data. It calculates the straight-line distance between two power-time analysis data sequences. The smaller the distance, the higher the similarity. For example Among them, p i and q iRepresent the power values ​​of the target device and similar devices at the i-th moment respectively. Based on information theory, it measures the degree of mutual dependence between two random variables. The larger the mutual information value, the more information is shared between the two variables, and the higher the similarity. Through similarity analysis, the difference between the operating characteristics of the target device and the historical data can be identified, and it can be determined whether the device has performance bottlenecks or areas that need to be optimized. The purpose of this step is to provide data support for the performance evaluation and optimization of the target device and help discover potential problems in the operation of the device.

[0092] S443, based on the data similarity between the power time analysis data corresponding to each monitoring point and the historical data of the same type of target device, the power time analysis data corresponding to the monitoring point with the smallest data similarity is screened out to be determined as the target side channel analysis data of the target device.

[0093] It can be understood that according to the similarity between the power-time analysis data of each monitoring point and the historical data of similar target devices, the similarity can be compared through a quotient algorithm or a sorting algorithm, and the power-time analysis data corresponding to the monitoring point with the smallest similarity can be screened out to determine the target side channel analysis data of the target device. The monitoring point with the smallest similarity usually means that the operating status of the target device at this monitoring point is significantly different from similar devices, reflecting the unique operating characteristics or potential problems of the target device. By screening out these key monitoring points, the performance and operating status of the target device can be evaluated more accurately. Target side channel analysis data is an important basis for device performance evaluation. By analyzing these data, the operating bottlenecks of the device can be identified, the execution process of the device can be optimized, and the overall performance can be improved.

[0094] S500, determining a side channel analysis result of the target device according to the target side channel analysis data of the target device.

[0095] It can be understood that the side channel attack risk of the target device is analyzed and evaluated based on the previously determined target side channel analysis data. Side channel attack refers to obtaining sensitive information of the device or affecting the normal operation of the device by analyzing the indirect output signals (such as power consumption, electromagnetic radiation, etc.) generated during the operation of the device. The target side channel analysis data provides the energy consumption and execution time characteristics of the device under different operating states. By analyzing these data, the potential risks of the device in terms of side channels can be identified. The side channel data can be preprocessed first, including noise removal, normalization, etc., and the preprocessed data can be analyzed using a pre-trained side channel analysis model to evaluate the side channel attack risk of the target device. For cryptographic algorithms, a small amount of side channel analysis data can also be used to crack the key to evaluate the side channel analysis results. A detailed side channel analysis report is generated based on the analysis results, including risk assessment results, potential vulnerabilities and recommended protection measures. The purpose of evaluating the side channel attack risk is to identify security vulnerabilities during the operation of the device, take necessary protection measures, and ensure the safety and reliability of the device. By analyzing the target side channel analysis data, it is possible to discover the potential security risks of the device during operation, formulate corresponding protection strategies, and reduce the risk of side channel attacks.

[0096] In one possible implementation, see Figure 7 S500, determining a side channel analysis result of the target device according to the target side channel analysis data of the target device, including:

[0097] S510, based on the target side channel analysis data of the target device, use the side channel analysis model to process the target side channel analysis data of the target device to obtain a side channel risk index of the target device; wherein the side channel analysis model is a machine learning model pre-trained using sample data.

[0098] It can be understood that the side channel analysis model is a machine learning model pre-trained with sample data. The sample data should contain side channel analysis data of various types of devices in normal operation and under side channel attacks, as well as corresponding risk labels. A large number of side channel analysis data of devices can be collected, including data in normal operation and under attack, and the risk level can be marked. The data can be pre-processed to extract key features, which may include frequency domain analysis, time domain analysis, etc. Select a suitable machine learning algorithm, such as random forest, support vector machine or deep learning model, train the model with labeled data sets, adjust hyperparameters to optimize model performance, and use an independent test set to verify the accuracy and generalization ability of the model. Use the side channel analysis model to process the target side channel analysis data of the target device to obtain the side channel risk index. The side channel analysis model is a model trained with a machine learning algorithm. By learning a large amount of sample data, it identifies and predicts the side channel attack risk of the device under different operating conditions. The side channel risk index is a quantitative indicator used to indicate the risk level of the device in terms of side channel attacks. In this way, the security of the device can be objectively evaluated and provide a basis for subsequent security protection measures. The training process of the side channel analysis model requires a large amount of sample data and rigorous verification to ensure the accuracy and reliability of the model.

[0099] S520: Determine a side channel analysis result of the target device based on the side channel risk index of the target device.

[0100] It can be understood that the side channel analysis results of the device are finally determined based on the side channel risk index of the target device. The risk index provides a quantitative indicator for evaluating the potential risk of the device in terms of side channel attacks. By analyzing this risk index, the security of the device in different operating states can be further determined. The side channel analysis results are a comprehensive assessment of the overall security of the device, helping to identify potential security risks during the operation of the device. Through in-depth analysis of the risk index, the weaknesses and vulnerabilities of the device in a specific state can be discovered, providing a strong basis for improving the security of the device.

[0101] Optionally, see Figure 8 S520, based on the side channel risk index of the target device, determining a side channel analysis result of the target device, including:

[0102] S521, performing side channel risk matching according to the target side channel analysis data of the target device to obtain a side channel risk label.

[0103] It can be understood that according to the target side channel analysis data of the target device, the side channel risk matching is performed to obtain the side channel risk label of the device. The risk label is a classification label used to describe the risk category of the device in terms of side channel attacks. For example, suppose the side channel risk index of the target device is 85 (full score is 100), which indicates that the device has a high risk in terms of side channel attacks. A series of risk thresholds can be pre-defined, for example, "low risk" corresponds to an index <30, "medium risk" corresponds to an index <70 of 30≤, and "high risk" corresponds to an index ≥70. The side channel risk index of 85 of the target device is compared with these thresholds to determine that it belongs to the "high risk" category. By matching the target side channel analysis data, the risk type of the device can be more accurately identified and provide a reference for the formulation of protective measures.

[0104] S522: Determine a side channel analysis result of the target device based on the side channel risk label.

[0105] It can be understood that the side channel analysis results of the device are finally determined based on the previously determined side channel risk labels. The risk labels provide classification information of device risks. Through comprehensive analysis of risk labels, the overall security status of the device can be determined. According to risk labels of different levels, a mapping relationship table can be preset to define the risk situation results that may exist under different risk levels, so as to obtain the risk level and possible risk type of the side channel of the target device, and thus obtain the side channel analysis results of the target device. For example, under the "high risk" category, the risk types are further subdivided, such as "power consumption fluctuation" and "electromagnetic leakage". The side channel analysis results are a comprehensive assessment of the device in terms of side channel attacks, helping to identify potential risks and safety hazards during the operation of the device. Through detailed risk label analysis, the specific weaknesses of the device under different operating states can be discovered, providing strong support for the security protection of the device, improving the quality of evaluation data, and achieving accurate in-depth monitoring and result analysis.

[0106] Corresponding to the side channel analysis method based on firmware instrumentation in the above embodiment, an embodiment of the present application further provides a side channel analysis device based on firmware instrumentation, and each unit of the device can implement each step of the side channel analysis method based on firmware instrumentation. Fig. 9 A structural block diagram of a side channel analysis device based on firmware instrumentation provided in an embodiment of the present application is shown. For ease of explanation, only the parts related to the embodiment of the present application are shown.

[0107] Reference Fig. 9 , the side channel analysis device based on firmware instrumentation includes:

[0108] An acquisition unit, used for acquiring an execution flow in a firmware image of a target device;

[0109] A parameter unit, configured to determine, according to the execution flow in the firmware image of the target device, an instrumentation parameter for monitoring a side channel signal during execution of the target device; wherein the instrumentation parameter includes at least three monitoring points for data collection;

[0110] A monitoring unit, configured to perform side channel signal monitoring through firmware instrumentation according to the instrumentation parameters, to obtain side channel data corresponding to each of the monitoring points and a current operating state corresponding to the target device at each of the monitoring points;

[0111] a data unit, configured to determine target side channel analysis data of the target device according to the side channel data corresponding to each of the monitoring points and the current operation state corresponding to the target device at each of the monitoring points;

[0112] A result unit is used to determine a side channel analysis result of the target device according to the target side channel analysis data of the target device.

[0113] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0114] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit module can exist physically separately, or two or more unit modules can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned device can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0115] The embodiment of the present application also provides a side channel analysis device based on firmware instrumentation, Fig.10 This is a schematic diagram of the structure of a side channel analysis device based on firmware instrumentation provided in one embodiment of the present application. Fig.10 As shown, the side channel analysis device 6 based on firmware instrumentation of this embodiment includes: at least one processor 60 ( Fig.10 Only one is shown), at least one memory 61 ( Fig.10Only one is shown in the figure) and a computer program 62 stored in the at least one memory 61 and executable on the at least one processor 60. When the processor 60 executes the computer program 62, the firmware instrumentation-based side-channel analysis device 6 implements the steps in any of the above-mentioned firmware instrumentation-based side-channel analysis method embodiments, or the firmware instrumentation-based side-channel analysis device 6 implements the functions of each unit in the above-mentioned device embodiments.

[0116] Exemplarily, the computer program 62 may be divided into one or more units, which are stored in the memory 61 and executed by the processor 60 to complete the present application. The one or more units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program 62 in the firmware instrumentation-based side channel analysis device 6.

[0117] The side channel analysis device 6 based on firmware instrumentation can be a mobile detection unit, a cloud-connected analysis device, a highly integrated portable detection toolkit, a desktop computer, a handheld device with wireless communication function, a computing device, a computer, a laptop computer, etc. The side channel analysis device based on firmware instrumentation can include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art can understand that Fig.10 It is only an example of the side-channel analysis device 6 based on firmware instrumentation and does not constitute a limitation of the side-channel analysis device 6 based on firmware instrumentation. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components, for example, it may also include input and output devices, network access devices, buses, etc.

[0118] The processor 60 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0119] In some embodiments, the memory 61 may be an internal storage unit of the side channel analysis device 6 based on firmware instrumentation, such as a hard disk or memory of the side channel analysis device 6 based on firmware instrumentation. In other embodiments, the memory 61 may also be an external storage device of the side channel analysis device 6 based on firmware instrumentation, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the side channel analysis device 6 based on firmware instrumentation. Further, the memory 61 may also include both the internal storage unit of the side channel analysis device 6 based on firmware instrumentation and an external storage device. The memory 61 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program, etc. The memory 61 may also be used to temporarily store data that has been output or is to be output.

[0120] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0121] An embodiment of the present application provides a computer program product. When the computer program product runs on a side-channel analysis device based on firmware instrumentation, the side-channel analysis device based on firmware instrumentation implements the steps in any of the above-mentioned method embodiments.

[0122] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device capable of carrying the computer program code to a side channel analysis device based on firmware plug-in, a recording medium, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), an electric carrier signal, a telecommunication signal, and a software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0123] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0124] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0125] In the embodiments provided in the present application, it should be understood that the disclosed side-channel analysis device based on firmware instrumentation / side-channel analysis equipment and method based on firmware instrumentation can be implemented in other ways. For example, the above-described side-channel analysis device based on firmware instrumentation / side-channel analysis device based on firmware instrumentation is merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0126] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0127] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A side channel analysis method based on firmware instrumentation, characterized in that: include: Get the execution flow in the firmware image of the target device; Determining, according to the execution flow in the firmware image of the target device, instrumentation parameters for monitoring side channel signals during the execution of the target device; wherein the instrumentation parameters include at least three monitoring points for data collection; Performing side channel signal monitoring through firmware instrumentation according to the instrumentation parameters to obtain side channel data corresponding to each of the monitoring points and a current operating state corresponding to the target device at each of the monitoring points; Determining target side channel analysis data of the target device according to the side channel data corresponding to each of the monitoring points and the current operation state corresponding to the target device at each of the monitoring points; A side channel analysis result of the target device is determined based on the target side channel analysis data of the target device.

2. The side channel analysis method based on firmware instrumentation according to claim 1, characterized in that: The determining, based on the execution flow in the firmware image of the target device, an instrumentation parameter for monitoring a side channel signal during execution of the target device comprises: According to the execution flow in the firmware image of the target device, each execution module in the firmware image and the instruction set on the execution module are parsed and processed according to a preset parsing rule to obtain an execution node of each execution module in the firmware image; Scan the execution node of each execution module in the firmware image to obtain the module identification and first position information of the execution node of the execution module; wherein the first position information includes the execution position information of the execution node of the execution module on the instruction set; According to the module identifier of the execution node of the execution module and the first location information, an instrumentation parameter for monitoring a side channel signal during execution of the target device is determined.

3. The side channel analysis method based on firmware instrumentation according to claim 2, characterized in that: The determining, based on the module identifier of the execution node of the execution module and the first location information, an instrumentation parameter for monitoring a side channel signal during execution of the target device includes: Dynamically grouping the target device execution process according to the module identifier of the execution node of the execution module and the first location information; According to a result of dynamically grouping the target device execution process, an instrumentation parameter for monitoring a side channel signal during the target device execution process is determined.

4. The side channel analysis method based on firmware instrumentation according to claim 3 is characterized in that: Dynamically grouping the target device execution process according to the module identifier of the execution node of the execution module includes: At least one monitoring group of the target device execution process is determined according to the module identifier of the execution node of the execution module; wherein the monitoring group is used to monitor the execution module of the target device.

5. The side channel analysis method based on firmware instrumentation according to claim 4, characterized in that: Dynamically grouping the target device execution process according to the first location information of the execution node of the execution module includes: According to the first location information of the execution node of the execution module, three monitoring locations of each monitoring group of the execution process of the target device are determined.

6. The side channel analysis method based on firmware instrumentation according to claim 5, characterized in that: The determining, based on a result of dynamically grouping the target device execution process, an instrumentation parameter for monitoring a side channel signal during the target device execution process includes: According to the result of dynamically grouping the target device execution process, the monitoring position of each monitoring group is determined as a monitoring point, and at least three monitoring points for monitoring the side channel signal during the target device execution process are obtained; According to all the monitoring points for monitoring the side channel signal during the execution of the target device, an instrumentation parameter for monitoring the side channel signal during the execution of the target device is determined.

7. The side channel analysis method based on firmware instrumentation according to claim 1, characterized in that: Determining target side channel analysis data of the target device according to the side channel data corresponding to each of the monitoring points and the current operation state corresponding to the target device at each of the monitoring points includes: Determine, for each of the monitoring points, a total operation duration and an instantaneous power level corresponding to each of the monitoring points based on the side channel data corresponding to each of the monitoring points and the current operation state corresponding to the target device at each of the monitoring points; Based on the total operation duration corresponding to each of the monitoring points, calculating the ratio of the total operation duration of each of the monitoring points to the current operation state, and obtaining the execution efficiency data corresponding to each of the monitoring points; Determine power-time analysis data corresponding to each of the monitoring points according to the execution efficiency data, the instantaneous power level and the total operation duration corresponding to each of the monitoring points; According to the power-time analysis data corresponding to each of the monitoring points, the power-time analysis data corresponding to all the monitoring points are screened to determine the target side channel analysis data of the target device.

8. The side channel analysis method based on firmware instrumentation according to claim 7, characterized in that: The step of screening the power time analysis data corresponding to all the monitoring points according to the power time analysis data corresponding to each of the monitoring points to determine the target side channel analysis data of the target device includes: Acquire historical data of target devices of the same type; wherein the historical data of target devices of the same type include power time analysis data corresponding to the same type of devices as the target device obtained after performing instrumentation monitoring on the devices; Determine the data similarity between the power time analysis data corresponding to each monitoring point and the historical data of the target device of the same type according to the power time analysis data corresponding to each monitoring point and the historical data of the target device of the same type; According to the data similarity between the power-time analysis data corresponding to each monitoring point and the historical data of the same type of target device, the power-time analysis data corresponding to the monitoring point with the smallest data similarity is screened out and determined as the target side channel analysis data of the target device.

9. The side channel analysis method based on firmware instrumentation according to claim 1, characterized in that: The determining, based on the target side channel analysis data of the target device, a side channel analysis result of the target device includes: According to the target side channel analysis data of the target device, the target side channel analysis data of the target device is processed using a side channel analysis model to obtain a side channel risk index of the target device; wherein the side channel analysis model is a machine learning model pre-trained using sample data; Based on the side channel risk index of the target device, a side channel analysis result of the target device is determined.

10. The side channel analysis method based on firmware instrumentation according to claim 9, characterized in that: The determining, based on the side channel risk index of the target device, a side channel analysis result of the target device includes: Performing side channel risk matching according to the target side channel analysis data of the target device to obtain a side channel risk label; Based on the side channel risk label, a side channel analysis result of the target device is determined.

Images