A dynamic time warping-based password side-channel analysis method

Abstract

The present application relates to the field of information security cryptography, and more particularly to a dynamic time warping based side channel analysis method for cryptography, comprising collecting side information (such as energy signal) of a device executing an asymmetric cryptography algorithm to obtain an energy trace, analyzing the collected energy trace to determine the region in the energy trace where the secret information related operation is executed; analyzing the energy trace of the cryptography algorithm execution, dividing the energy trace into energy trace segments according to the signal peak value; selecting an energy trace segment as a reference energy trace segment, applying the DTW algorithm to each energy trace segment and the reference energy trace segment to find the distance value between the two clusters of column charts in the graph as a distinguishing value; using the distinguishing value to divide the DTW distance result into two categories to obtain two types of operation corresponding to the energy trace segments, and the two categories correspond to two different operation results of the asymmetric cryptography algorithm, thereby inferring the key information, and the method is effective for the energy trace, and is still effective for the electromagnetic trace and the illumination trace.

Description

Technical Field

[0001] This invention relates to the field of information security cryptography, and more specifically, to a cryptographic side-channel analysis method based on dynamic time warping. Background Technology

[0002] Security chips are widely used in various devices to protect data. Cryptography is one of the key means by which security chips protect data. Cryptography is a technical science involving encryption and decryption, used to ensure the security, confidentiality, and integrity of data. Its core purpose is to protect information through various methods and algorithms, making it impossible to read or tamper with without authorization. Cryptography has a wide range of applications, including e-commerce, network security, email encryption, and various data protection measures. With the widespread application of cryptography, it is used in many embedded devices, such as smart cards, mobile phones, and microcontrollers. These devices generate a lot of side-channel information during use, which analysts can analyze to obtain keys.

[0003] In 1999, Kocher et al. proposed Simple Power Analysis (SPA), a very direct side-channel analysis method. It uses detailed observation of a device's energy consumption during encryption operations to infer specific information about the device's operation, especially the encryption key. Typical examples of asymmetric cryptography algorithms include RSA and ECC, which typically involve numerous exponentiation and modular operations. These operations produce different energy consumption characteristics at the hardware level: RSA is a "square-multiplication" algorithm, and ECC is a "dot-multiplication-dot-dot" algorithm. Therefore, SPA analysts can infer key information by observing these energy traces.

[0004] When performing SPA analysis on asymmetric cryptographic algorithms, the length of each energy trace (representing the energy trace processed by a single private key bit) varies due to the long runtime of RSA or ECC algorithms, the large data scale, and the different time requirements of the two different operations. Clock jitter or random delays also affect the length of the energy trace. For traditional dimensionality reduction-clustering methods, dimensionality reduction requires different energy traces to have the same length. How to adjust unequal-length sequences to the same length is controversial (e.g., zero padding, truncation, multiple truncation, interpolation, etc.), and such adjustments may affect the original characteristics of the data, thus altering the information used for side-channel analysis. In 1978, Sakoe Hiroaki and Seibi Chiba proposed the Dynamic Time Warping algorithm, initially developed for matching and aligning time series in speech recognition. Dynamic Time Warping can be used to align two time series with different lengths or time axes to compare their similarity; the algorithm can also calculate the similarity between two time series. This scheme is mainly designed for asymmetric cryptography algorithms, but its main ideas can also be applied to symmetric cryptography algorithms to distinguish the round operations of the algorithm. Summary of the Invention

[0005] In view of this, the purpose of this invention is to address the problems of large scale of energy trace data in cryptographic algorithms, high analysis difficulty, and the inability of traditional "dimensionality reduction-clustering" methods to handle energy trace fragments of unequal length. It innovatively proposes a cryptographic side-channel analysis method based on dynamic time warping. By using dynamic time warping to distinguish the energy traces corresponding to different operation types in asymmetric cryptographic algorithms, it is possible to efficiently and automatically deduce the key of cryptographic algorithms.

[0006] A cryptographic side-channel analysis method based on dynamic time warping includes the following steps:

[0007] Step 1: Collect side information (such as power signals) from the device executing the asymmetric cryptographic algorithm to obtain the power trace. Analyze the collected power trace to determine the region in the power trace where operations related to secret information are performed.

[0008] Step 2: Analyze the energy trace of the executed cryptographic algorithm and divide the energy trace into energy trace segments based on the signal peaks;

[0009] Step 3: Select an energy trace segment as a reference energy trace segment, apply the DTW algorithm to each energy trace segment and the reference energy trace segment, and calculate the DTW distance between the two segments;

[0010] Step 4: Display all the obtained DTW distance results using a stacked bar chart, and find the distance value between two clusters of bars in the chart as the distinguishing value;

[0011] Step 5: Use the discriminant value to divide the DTW distance results into two categories, obtain the two operation types corresponding to the energy trace fragments. These two categories correspond to two different operation results of the asymmetric cryptography algorithm, thereby inferring the key information.

[0012] According to an example of an embodiment of the present invention, in step 3, an energy trace segment is selected as a reference energy trace segment, and the DTW algorithm is applied to each energy trace segment and the reference energy trace segment to calculate the DTW distance between the two segments;

[0013] The algorithm selects the energy trace fragment as the reference fragment, then iterates through all energy trace fragments and applies the DTW algorithm to calculate the DTW distance between the reference fragments.

[0014] According to an example of an embodiment of the present invention, in step 4, all the obtained DTW distance results are displayed using a stacked column chart, and the distance value between two clusters of column charts in the chart is used as the distinguishing value;

[0015] Each segment of the energy trace has a corresponding DTW distance result value. These results are plotted into a stacked plot, i.e., a bar chart. The horizontal axis of the bar chart is an interval, and each bar is closely connected to the others. Since the selected reference energy trace and its own DTW distance result value will be 0, the smallest 0 is not considered when plotting the stacked plot. The final stacked plot will show two major categories, and the value in between the two categories is the distinguishing value.

[0016] According to an example of an embodiment of the present invention, in step 5, the DTW distance result is divided into two categories using a distinguishing value to obtain two types of operation types corresponding to the energy trace fragments. These two categories correspond to two different operation results of the asymmetric cryptographic algorithm, thereby inferring the key information.

[0017] The modular exponentiation operation in the RSA algorithm consists of only two operations: squaring and multiplication. The energy trace fragments are directly divided into two categories using the distinguishing value; one category represents the message operation "squaring" and the other represents the operation "multiplication".

[0018] The beneficial effects of this application include at least the following: using the DTW algorithm to obtain the intermediate value sequence related to the key in the algorithm. This invention directly uses energy trace fragments of unequal length for classification without padding, adapting to noise of unequal length and thus preserving data integrity. The method of this invention does not require collecting multiple energy traces, enabling efficient cryptanalysis; and this method is effective for energy traces, as well as electromagnetic and illuminance traces.

[0019] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and are not intended to limit the technical solutions of this application. Attached Figure Description

[0020] The above and other objects, features, and advantages of the present invention will become more apparent from the more detailed description of the embodiments of the invention in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same parts or steps.

[0021] Figure 1 This is a flowchart of the method of the present invention;

[0022] Figure 2 This is a schematic diagram of the energy trace of the RSA algorithm on the Sakura-G development board in the embodiment of the method of the present invention;

[0023] Figure 3 This is an enlarged view of the energy trace in an embodiment of the method of the present invention;

[0024] Figure 4 This is a schematic diagram of energy trace operation partitioning in an embodiment of the method of the present invention;

[0025] Figure 5 This is an enlarged view of the energy trace fragment in an embodiment of the method of the present invention;

[0026] Figure 6 This is a schematic diagram of the DTW results in an embodiment of the method of the present invention;

[0027] Figure 7 This is a schematic diagram of the K-Means clustering results in an embodiment of the method of the present invention. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application are further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be considered as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application. In the following description, the term "optional implementation" is used, which describes a subset of all possible embodiments. However, it is understood that "optional implementation" can be the same subset or different subsets of all possible embodiments and can be combined with each other without conflict. The terms "first / second" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first / second" can be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs. The terminology used herein is for the purpose of describing this application only and is not intended to limit this application.

[0030] The embodiments of this application provide, taking the RSA algorithm as an example, to collect energy information running on the SAKURA-G development board, and to recover the secret information of the algorithm using the method of this invention;

[0031] It should be noted that this plan is to be used under legal circumstances;

[0032] like Figure 1 As shown, a cryptographic side-channel analysis method based on dynamic time warping includes the following steps:

[0033] Step 1: Prepare the hardware and software platform, collect the side information of the device executing the asymmetric cryptography algorithm to obtain the energy trace, locate the part of the energy trace that is encrypted by the algorithm, and determine the area in the energy trace that performs operations related to the secret information.

[0034] Specifically, after setting up the hardware and software platform, the complete energy trace of the RSA algorithm encryption performed on the SAKURA-G development board is collected, such as... Figure 2 As shown. Because the square and multiplication operations in the RSA encryption process consume a lot of energy, the part with higher energy traces in the graph is determined to be the encrypted part;

[0035] Step 2: Analyze the energy trace of the executed cryptographic algorithm and divide the energy trace into energy trace segments based on the signal peaks;

[0036] Specifically, according to the RSA algorithm, modular exponentiation involves two operations: squaring and multiplication. These two operations may exhibit different characteristics in the energy trace. Given that the secret exponent length of a single modular exponentiation operation is 1024 bits, if all bits of the secret exponent are 0, then the squaring operation is performed 1024 times; if all bits of the secret exponent are 1, then both the squaring and multiplication operations are performed 1024 times, for a total of 2048 operations. Therefore, the number of operations ranges from 1024 to 2048. Observing the energy trace and magnifying this part, we can see different operations, with tiny spikes before and after each operation, such as... Figure 3 As shown in the figure. The peak values ​​before and after the operation are used to divide the data, and the division results are as follows. Figure 4 As shown;

[0037] Step 3: Select an energy trace segment as a reference energy trace segment, apply the DTW algorithm to each energy trace segment and the reference energy trace segment, and calculate the DTW distance between the two segments;

[0038] Specifically, after division, individual energy trace fragments are as follows: Figure 5 As shown, the algorithm of this invention selects the energy trace segment as the reference segment, then traverses all energy trace segments and applies the DTW algorithm to calculate the DTW distance between the reference segments; for each calculation, let the two energy trace segments be A and B, and the points on them be A. i and B i The lengths of A and B are respectively , Then we can build a The table represents the positions of points on each energy trace A and B on the horizontal and vertical axes, with values ​​indicating the distances between corresponding points. For example, (1,1) in the table represents the distance between the first point of energy trace A and the first point of energy trace B. The DTW algorithm needs to find a path from the bottom left corner to the top right corner of the table, denoted as . The starting point is and the endpoint is This path needs to minimize the cumulative distance; this path represents the optimal alignment between two time series.

[0039] First, this path is not chosen arbitrarily; it must satisfy the following constraints:

[0040] 1) Boundary conditions: arrive For the DTW algorithm, the speed of pronunciation of any speech may vary, but the order of its parts cannot be changed. Therefore, the selected path must start from the lower left corner and end at the upper right corner.

[0041] 2) Continuity: If Then for the next point on the path Need to meet and In other words, it's impossible to cross a certain point to match; you can only align with points adjacent to yourself. This ensures that every coordinate in A and B is within the range of the points in the range. Appears in;

[0042] 3) Monotonicity: If Then for the next point on the path Need to meet and This restriction The points mentioned above must be monotonically changed over time to ensure that the time sequence between corresponding points is not disrupted.

[0043] Combining the continuity and monotonicity constraints, the path to each grid point has only three directions; for example, if the path has already passed through the grid point... Then the next grid point to pass through can only be one of the following three cases: , or .

[0044] The algorithm then uses dynamic programming to perform subsequent calculations, that is, it uses recursive formulas. Go to fill in the table, where It is the cumulative distance. This represents the distance between individual points. The final result in the upper right corner of the table is the distance calculation result of the DTW algorithm. Since the DTW algorithm takes a long time, the Fast-DTW algorithm can be used to speed up the algorithm by reducing the size of the table.

[0045] Step 4: Display all the obtained DTW distance results using a stacked bar chart, and find the distance value between two clusters of bars in the chart as the distinguishing value;

[0046] Specifically, after step three, each segmented energy trace has a corresponding DTW distance result value. These results are plotted into a stacked graph, i.e., a histogram. The horizontal axis of the histogram represents an interval, and each histogram is closely connected to the others. Since the selected reference energy trace and its own DTW distance result value will be 0, the smallest value of 0 is not considered when plotting the stacked graph. For this example, the result is as follows: Figure 6 As shown in the figure, the data can be roughly divided into two categories, with the dividing point between these two categories around 60. Therefore, 60 was chosen as the distinguishing value.

[0047] Step 5: Use the discriminant value to divide the DTW distance results into two categories, obtain the two operation types corresponding to the energy trace fragments. These two categories correspond to two different operation results of the asymmetric cryptography algorithm, thereby inferring the key information.

[0048] Specifically, the modular exponentiation operation in the RSA algorithm involves only two operations: squaring and multiplication. The energy trace fragments are directly divided into two categories using a discriminant value. One category represents the message operation "squaring," and the other represents the operation "multiplication." The category with more guessed sample points represents "squaring." The message sequence is then recovered, and the key is attempted to be calculated. In this embodiment, the key recovery accuracy is 99.54%. For misclassified operation fragments, their possible values ​​are iterated to attempt key recovery. Under the same partitioning, each energy trace fragment is padded with zeros to ensure the same fragment length. Then, PCA dimensionality reduction and K-Means clustering are used to classify the operation points. The classification results are as follows: Figure 7 As shown, the color of the dots reflects the result of a single K-Means experiment, and the shape of the dots reflects the correct classification result. Experimental results show that the average accuracy of 1000 clustering results is 75.73%, thus proving that the method of this invention is superior to traditional dimensionality reduction-clustering methods.

[0049] It should be noted that the object information (including but not limited to the object's device information, corresponding personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the object or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0050] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of this application. It should be noted that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A cryptographic side-channel analysis method based on dynamic time warping, characterized in that, Includes the following steps: Step 1: Collect side information of the device executing the asymmetric cryptographic algorithm to obtain the energy trace, analyze the collected energy trace, and determine the region in the energy trace that performs operations related to secret information; Step 2: Analyze the energy trace of the executed cryptographic algorithm and divide the energy trace into energy trace segments based on the signal peaks; Step 3: Select an energy trace segment as a reference energy trace segment, apply the DTW algorithm to each energy trace segment and the reference energy trace segment, and calculate the DTW distance between the two segments; Step 4: Display all the obtained DTW distance results using a stacked bar chart, and find the distance value between two clusters of bars in the chart as the distinguishing value; Step 5: Use the discriminant value to divide the DTW distance results into two categories, obtain the two operation types corresponding to the energy trace fragments. These two categories correspond to two different operation results of the asymmetric cryptography algorithm, thereby inferring the key information.

2. The cryptographic side-channel analysis method based on dynamic time warping as described in claim 1, characterized in that, In step 3, an energy trace segment is selected as a reference energy trace segment, and the DTW algorithm is applied to each energy trace segment and the reference energy trace segment to calculate the DTW distance between the two segments. The algorithm selects the energy trace fragment as the reference fragment, then iterates through all energy trace fragments and applies the DTW algorithm to calculate the DTW distance between the reference fragments.

3. The cryptographic side-channel analysis method based on dynamic time warping as described in claim 1, characterized in that, In step 4, all the obtained DTW distance results are displayed using a stacked column chart, and the distance value between two clusters of column charts in the chart is used as the distinguishing value. Each segment of the energy trace has a corresponding DTW distance result value. These results are plotted into a stacked plot, i.e., a bar chart. The horizontal axis of the bar chart is an interval, and each bar is closely connected to the others. Since the selected reference energy trace and its own DTW distance result value will be 0, the smallest 0 is not considered when plotting the stacked plot. The final stacked plot will show two major categories, and the value in between the two categories is the distinguishing value.

4. The cryptographic side-channel analysis method based on dynamic time warping as described in claim 1, characterized in that, In step 5, the DTW distance results are divided into two categories using the discrimination value, and two operation types corresponding to the energy trace fragments are obtained. These two categories correspond to two different operation results of the asymmetric cryptography algorithm, thereby inferring the key information. The RSA algorithm's modular exponentiation operation contains only two operations: squaring and multiplication. The energy trace fragments are directly divided into two categories using the distinguishing value; one category represents the message operation "squaring" and the other represents the operation "multiplication".

Images