Multi-source side information acquisition and fusion detection method, system and device for password equipment

Abstract

The invention belongs to the technical field of information security passwords, and relates to a multi-source side information acquisition and fusion detection method, system and device for a password device, which can cooperatively acquire various side channel leakage signals such as illumination, electromagnetism and energy in the operation process of the password device and perform efficient fusion analysis on the signals, thereby improving the security of the password device. Therefore, the utilization efficiency and the detection accuracy of multi-source side information leakage are remarkably improved, and the safety guarantee capability of the password equipment is enhanced.

Description

Technical Field

[0001] The present invention relates to a method, system and device for multi-source information collection and fusion detection of cryptographic equipment, and specifically to a method, system and device for collaborative collection and fusion detection of information leakage from multi-source sides of cryptographic equipment based on illumination, energy, electromagnetic and the like, belonging to the field of information security cryptographic technology. Background Art

[0002] Traditional security detection methods for cryptographic devices mainly focus on leakage sources such as energy signals and electromagnetic signals. However, the latest research shows that the brightness changes (i.e., illumination signals) of LED power lights, which are usually equipped in cryptographic devices, can also be used as a potential source of leakage signals. However, there is currently no mature solution for security detection using illumination signals.

[0003] At present, the detection method of leaked information sources usually relies on a single side channel, such as an energy channel or an electromagnetic channel. This single channel method inevitably causes information loss and is difficult to fully reflect the full picture of side information leakage. How to integrate the leakage information of multiple side channels and realize comprehensive analysis and utilization will significantly improve the effect and accuracy of detection. Summary of the invention

[0004] The present invention aims to solve the problem of coordinated collection and fusion utilization of information leakage from multiple sources such as illumination, energy, and electromagnetic in the security detection of cryptographic equipment in view of the deficiencies of the prior art. An innovative method, system, and device for multi-source information collection and fusion detection of cryptographic equipment are proposed. The method can synchronously collect multiple leakage signals such as illumination, electromagnetic, and energy during the operation of the cryptographic equipment, and perform efficient fusion analysis on them, thereby significantly improving the utilization efficiency and detection accuracy of multi-source information leakage, and enhancing the security protection capability of the cryptographic equipment.

[0005] According to a first aspect of an embodiment of the present invention, a method for multi-source side information collection and fusion detection of a cryptographic device is provided, comprising: Step 1: Run the target cryptographic algorithm on the cryptographic device, control the known key input, collaboratively collect the illumination, electromagnetic and energy signals of the cryptographic device during the execution of the cryptographic algorithm, intercept the waveform when the cryptographic algorithm is executed, and perform pre-processing operations such as filtering and alignment on the intercepted waveform to generate a high-quality multi-source information training data set.

[0006] Step 2: A multi-source information fusion detection model is established based on a multi-layer perceptron (MLP) or a convolutional neural network (CNN). By inputting the multi-source information training data set collected in step 1, the training model realizes the effective fusion of multi-source information such as contrast, electromagnetic and energy, and obtains a multi-source information fusion detection model with high information fusion rate and high detection accuracy.

[0007] Preferably, the fusion layer of the multi-source information fusion detection model can select a variety of operations to fuse the multi-source information, including addition, subtraction, multiplication, average, maximum, minimum, splicing, etc.

[0008] Step 3: Run the target cryptographic algorithm on the same model of cryptographic device with unknown key, and collaboratively collect the illumination, electromagnetic and energy signals of the cryptographic device during the execution of the cryptographic algorithm, intercept the waveform when the cryptographic algorithm is executed, and perform pre-processing operations such as filtering and alignment on the intercepted waveform to generate a high-quality multi-source information test data set.

[0009] Step 4: Use the multi-source information fusion detection model obtained in step 2 to test the multi-source information test data set obtained in step 3 to detect whether there is any key information leakage.

[0010] According to a second aspect of an embodiment of the present invention, a multi-source side information collection and fusion detection system for a cryptographic device is provided, comprising: A collection module, used for sending instructions for running a cryptographic algorithm to a cryptographic device, and collecting illumination, electromagnetic and energy signal waveforms when the cryptographic algorithm is running; wherein the random number inputs of the cryptographic algorithm running instructions are different; An interception module, used to intercept the waveforms of the illumination, electromagnetic and energy signal waveforms when the cryptographic algorithm operation is performed, and perform pre-processing operations such as filtering and alignment on the intercepted waveforms; The first computing module is used to establish a multi-source information fusion detection model based on a multi-layer perceptron (MLP) or a convolutional neural network (CNN) according to the preprocessed cryptographic algorithm multi-source information training data set, and to train to obtain a multi-source information fusion detection model with a high information fusion rate and a high detection accuracy rate; The second computing module is used to test the multi-source information fusion detection model based on the preprocessed cryptographic algorithm multi-source information test data set to detect whether the cryptographic device has key information leakage.

[0011] According to a third aspect of an embodiment of the present invention, a multi-source side information collection and fusion detection device for a cryptographic device is provided, comprising: comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor. The instructions are executed by the at least one processor so that the at least one processor can perform the above method.

[0012] According to a fourth aspect of an embodiment of the present invention, there is provided a non-transitory computer-readable storage medium storing computer instructions, including: computer instructions for causing a computer to execute the above method.

[0013] Beneficial Effects The present invention can collaboratively collect multi-source information leakage such as illumination, electromagnetic, and energy during the operation of cryptographic equipment, and effectively integrate them, greatly improving the utilization rate and accuracy of multi-source information leakage in cryptographic equipment security detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is a flow chart of the present invention; Figure 2 is a schematic diagram of an illumination signal collected by a multi-source information collaborative collection device in an embodiment of the present invention; Figure 3 is a schematic diagram of electromagnetic signals collected by a multi-source information collaborative collection device in an embodiment of the present invention; Figure 4 is a schematic diagram of energy signals collected by a multi-source information collaborative collection device in an embodiment of the present invention; Figure 5 Schematic diagram of a multi-source information fusion detection model architecture based on a convolutional neural network in an embodiment of the present invention; Figure 6 is a schematic diagram of the result of leakage detection of the first byte key of the AES algorithm in an embodiment of the present invention; Figure 7 It is a structural diagram of a multi-source side information collection and fusion detection system for a cryptographic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0015] The detailed steps of the present invention are described below in conjunction with the accompanying drawings and embodiments.

[0016] Embodiment 1 Taking the AES algorithm as an example, the present invention is used to collaboratively collect the illumination, electromagnetic and energy multi-source information waveforms running on the STM32F429 development board, and perform multi-source information fusion detection on the waveform set.

[0017] like Figure 1 As shown, a method for multi-source side information collection and fusion detection of a cryptographic device includes the following steps: Step 1: Run the target cryptographic algorithm on the cryptographic device, control the known key input, collaboratively collect the illumination, electromagnetic and energy signals of the cryptographic device during the execution of the cryptographic algorithm, intercept the waveform when the cryptographic algorithm is executed, and perform pre-processing operations such as filtering and alignment on the intercepted waveform to generate a high-quality multi-source information training data set.

[0018] In the embodiment, an AES algorithm with a known key of 0x00112233445566778899AABBCCDDEEFF is run on the STM32F429 development board, and the illumination, electromagnetic and energy signals of the STM32F429 development board during the execution of the cryptographic algorithm are collaboratively collected, the waveform when the cryptographic algorithm is executed is intercepted, and the intercepted waveform is filtered, aligned and other preprocessing operations are performed to generate a high-quality multi-source information training data set, and the collected illumination, electromagnetic and energy signals are respectively as shown in Figure 2 , 3 , as shown in Figure 4.

[0019] Step 2: A multi-source information fusion detection model is established based on a multi-layer perceptron (MLP) or a convolutional neural network (CNN). By inputting the multi-source information training data set collected in step 1, the training model realizes the effective fusion of multi-source information such as contrast, electromagnetic and energy, and obtains a multi-source information fusion detection model with high information fusion rate and high detection accuracy.

[0020] Preferably, the fusion layer of the multi-source information fusion detection model can select a variety of operations to fuse the multi-source information, including addition, subtraction, multiplication, average, maximum, minimum, splicing, etc.

[0021] In the embodiment, a multi-source information fusion detection model is established based on a convolutional neural network (CNN), and the model architecture is as follows: Figure 5 As shown, the fusion layer selects the addition operation, and by inputting the multi-source information training data set collected in step 1, the training model realizes the effective fusion of multi-source information such as illumination, electromagnetic and energy, and obtains a multi-source information fusion detection model with high information fusion rate and high detection accuracy.

[0022] Step 3: Run the target cryptographic algorithm on the same model of cryptographic device with unknown key, and collaboratively collect the illumination, electromagnetic and energy signals of the cryptographic device during the execution of the cryptographic algorithm, intercept the waveform when the cryptographic algorithm is executed, and perform pre-processing operations such as filtering and alignment on the intercepted waveform to generate a high-quality multi-source information test data set.

[0023] In the embodiment, an AES cryptographic algorithm is run on an STM32F429 development board with an unknown key, and the illumination, electromagnetic and energy signals of the STM32F429 development board during the execution of the AES algorithm are collaboratively collected, the waveform when the cryptographic algorithm operation is executed is intercepted, and the intercepted waveform is preprocessed by filtering, alignment and other preprocessing operations to generate a high-quality multi-source information test data set.

[0024] Step 4: Use the multi-source information fusion detection model obtained in step 2 to test the multi-source information test data set obtained in step 3 to detect whether there is any key information leakage.

[0025] In the embodiment, the multi-source information fusion detection model obtained in step 2 is used to test the multi-source information test data set obtained in step 3 to detect whether there is key information leakage. The detection result of the first byte key of AES is as follows: Figure 6 As shown, the detection result shows that the key is 0x00, which is consistent with the set key, that is, there is a leak.

[0026] Embodiment 2 See also Figure 7 , Figure 7 The present invention is a schematic structural diagram of a multi-source side information collection and fusion detection system for a cryptographic device according to an exemplary embodiment, including: A collection module, used for sending instructions for running a cryptographic algorithm to a cryptographic device, and collecting illumination, electromagnetic and energy signal waveforms when the cryptographic algorithm is running; wherein the random number inputs of the cryptographic algorithm running instructions are different; In the embodiment, the photoelectric conversion module is aligned with the power LED lamp on the STM32F429 development board to collect its illumination information, the electromagnetic probe is aligned with the capacitor of a power circuit on the STM32F429 development board to collect its electromagnetic information, and the energy probe is placed on one end of the resistor of a power circuit on the STM32F429 development board to collect its energy information.

[0027] An interception module, used to intercept the waveforms of the illumination, electromagnetic and energy signal waveforms when the cryptographic algorithm operation is performed, and perform pre-processing operations such as filtering and alignment on the intercepted waveforms; The first computing module is used to establish a multi-source information fusion detection model based on a multi-layer perceptron (MLP) or a convolutional neural network (CNN) according to the preprocessed cryptographic algorithm multi-source information training data set, and to train to obtain a multi-source information fusion detection model with a high information fusion rate and a high detection accuracy rate; The second computing module is used to test the multi-source information fusion detection model based on the preprocessed cryptographic algorithm multi-source information test data set to detect whether the cryptographic device has key information leakage.

[0028] Embodiment 3 A multi-source information collection and fusion detection device for a cryptographic device, characterized by comprising: comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor. The instructions are executed by the at least one processor so that the at least one processor can perform the above method.

[0029] It should be noted that the implementation method and beneficial effects of each module in this embodiment can be found in the introduction of the relevant steps in Example 1, and will not be repeated in this embodiment.

[0030] Embodiment 4 A non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to enable a computer to execute the above method.

[0031] It should be noted that the implementation method and beneficial effects of each module in this embodiment can be found in the introduction of the relevant steps in Example 1, and will not be repeated in this embodiment.

[0032] It can be understood that the same or similar parts of the above embodiments can be referenced to each other, and the contents not described in detail in some embodiments can refer to the same or similar contents in other embodiments.

[0033] It should be noted that, in the description of the present invention, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of the present invention, unless otherwise specified, the meaning of "plurality" refers to at least two.

[0034] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0035] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0036] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0037] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0038] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0039] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0040] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

[0041] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification. The above-mentioned embodiments only express several implementation methods of the present application, and their descriptions are relatively specific and detailed, but they cannot be understood as limiting the scope of the patent of this application. It should be pointed out that for ordinary technicians in this field, without departing from the concept of the present application, several deformations and improvements can be made, which all belong to the scope of protection of the present application. Therefore, the scope of protection of the present application shall be based on the attached claims.

Claims

1. A method for multi-source information collection and fusion detection of cryptographic equipment, characterized in that: The following steps are involved: Step 1: Run the target cryptographic algorithm on the cryptographic device, control the known key input, collaboratively collect the illumination, electromagnetic and energy signals of the cryptographic device during the execution of the cryptographic algorithm, intercept the waveform when the cryptographic algorithm is executed, and perform filtering and alignment preprocessing operations on the intercepted waveform to generate a high-quality multi-source information training data set; Step 2: Establish a multi-source information fusion detection model based on a multi-layer perceptron MLP or a convolutional neural network CNN. By inputting the multi-source information training data set collected in step 1, the training model realizes the effective fusion of multi-source information of contrast, electromagnetic and energy, and obtains a multi-source information fusion detection model with high information fusion rate and high detection accuracy; The fusion layer of the multi-source information fusion detection model can select a variety of operations to fuse multi-source information, including addition, subtraction, multiplication, average, maximum, minimum, and splicing; Step 3: Run the target cryptographic algorithm on the same model of cryptographic device with unknown key, and collaboratively collect the illumination, electromagnetic and energy signals of the cryptographic device during the execution of the cryptographic algorithm, intercept the waveform when the cryptographic algorithm is executed, and perform filtering and alignment preprocessing operations on the intercepted waveform to generate a high-quality multi-source information test data set; Step 4: Use the multi-source information fusion detection model obtained in step 2 to test the multi-source information test data set obtained in step 3 to detect whether there is any key information leakage.

2. According to the method for multi-source information collection and fusion detection of a cryptographic device as described in claim 1, a multi-source information collection and fusion detection system for a cryptographic device is proposed, characterized in that: include: A collection module, used for sending instructions for running a cryptographic algorithm to a cryptographic device, and collecting illumination, electromagnetic and energy signal waveforms when the cryptographic algorithm is running; wherein the random number inputs of the cryptographic algorithm running instructions are different; An interception module, used for intercepting the waveforms of the illumination, electromagnetic and energy signal waveforms when the cryptographic algorithm operation is performed, and performing filtering and alignment preprocessing operations on the intercepted waveforms; The first computing module is used to establish a multi-source information fusion detection model based on a multi-layer perceptron MLP or a convolutional neural network CNN according to the preprocessed cryptographic algorithm multi-source information training data set, and to train to obtain a multi-source information fusion detection model with a high information fusion rate and a high detection accuracy rate; The second computing module is used to test the multi-source information fusion detection model based on the preprocessed cryptographic algorithm multi-source information test data set to detect whether the cryptographic device has key information leakage.

3. According to the method for multi-source information collection and fusion detection of a cryptographic device described in claim 1, a multi-source information collection and fusion detection device for a cryptographic device is proposed, characterized in that: include: Several processors; and a memory communicatively connected to the plurality of processors; wherein the memory stores instructions executable by the plurality of processors, and the instructions are executed by the plurality of processors so that the plurality of processors can execute the above-mentioned method.

4. According to the method for multi-source information collection and fusion detection of a cryptographic device as described in claim 1, a non-transitory computer-readable storage medium storing computer instructions is proposed, comprising: The computer instructions are used to make the computer execute the above method.

Images