Side channel analysis method and system for CKKS embedded implementation

Abstract

The present invention belongs to the field of cyberspace security technology and specifically discloses a side channel analysis method and system for CKKS embedded implementation, comprising: obtaining electromagnetic traces when a CKKS embedded device executes a target algorithm; constructing a template based on the operation being executed for the obtained electromagnetic traces, locating the leakage location, and identifying the leakage location; inputting the electromagnetic traces of the identified leakage location into a trained interconnected convolutional neural network to obtain a predicted probability distribution for each category, thereby obtaining a predicted leakage category; constructing a factor graph of the target algorithm, integrating the relationships between multiple leakage information through a belief propagation algorithm, optimizing the predicted classification results, and obtaining optimized leakage categories. The present invention designs a deep neural network considering the leakage characteristics of bit splicing, uses a factor graph to construct the relationships between leakage information, and obtains the final side channel analysis results, thereby achieving higher accuracy in side channel analysis.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security technology, and in particular to a side channel analysis method and system for CKKS embedded implementation. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] Fully homomorphic encryption (FHE) is a cryptographic technique that enables computations to be performed on encrypted data, ensuring the security of the computation process. This capability makes FHE valuable in applications such as secure data analysis and processing, such as cloud computing and privacy-preserving machine learning.

[0004] CKKS (Cheon-Kim-Kim-Song Encryption Scheme) is a lattice-based fully homomorphic encryption scheme that uses near-homomorphic encryption and allows operations on floating-point values. Due to its low resource overhead and high execution efficiency, CKKS has broad application prospects in embedded devices.

[0005] To accelerate implementation and provide convenient and fast deployment, the Simple Encrypted Arithmetic-Embedded (SEAL-Embedded) library has been developed. The SEAL-Embedded library incorporates "bit-stitching" technology to optimize the implementation of CKKS symmetric and asymmetric encryption. This reduces the memory overhead of encryption in embedded devices, thereby providing an efficient CKKS implementation for resource-constrained embedded devices.

[0006] Although CKKS is secure from a mathematical analysis perspective, side-channel leaks can still occur when implemented on embedded devices. A variety of side-channel analysis techniques have been developed for lattice ciphers, primarily targeting NTT transformations, polynomial multiplication, Gaussian sampling, and message encoding / decoding. However, these attacks primarily target vulnerabilities in lattice cipher implementations. CKKS's homomorphic encryption and floating-point calculations significantly differ its data flow and operational methods from traditional lattice ciphers. Therefore, these techniques are not directly applicable to CKKS embedded implementations. Summary of the Invention

[0007] To address the above problems, the present invention proposes a side-channel analysis method and system for CKKS embedded implementation. The algorithm is executed targeting the polynomial sampling module in the SEAL-Embedded library. A deep neural network is designed considering the leakage characteristics of bit splicing. The leakage intensity of electromagnetic traces is quantitatively analyzed by the deep neural network, and the relationship between the leakage information is constructed using a factor graph to obtain the final side-channel analysis results.

[0008] In some embodiments, the following technical solutions are adopted:

[0009] A side channel analysis method for CKKS embedded implementation, including:

[0010] Obtain electromagnetic traces when the CKKS embedded device executes the target algorithm;

[0011] For the acquired electromagnetic traces, a template is constructed based on the operation being performed to locate and identify the leak location;

[0012] Inputting the electromagnetic traces that identify the leak location into a trained interconnected convolutional neural network to obtain a predicted probability distribution for each category, thereby obtaining the predicted leak category; wherein the interconnected convolutional neural network takes four trace segments as input at a time, and the features of the four trace segments correspond to the four coefficients in the bit-spliced ​​byte respectively;

[0013] Construct a factor graph of the target algorithm, integrate the relationships between multiple leakage information through the belief propagation algorithm, optimize the predicted classification results, and obtain the optimized leakage category.

[0014] As a further solution, for the acquired electromagnetic traces, a template is constructed based on the operation being performed to locate the leak. The specific process is as follows:

[0015] The operation being performed at the leakage location is taken as the target operation, the energy consumption trace of the target operation is obtained, the mean and covariance matrix of the energy consumption trace are calculated, and a template corresponding to the target operation is obtained;

[0016] A sliding window is used to perform template matching on the entire acquired electromagnetic trace in segments, and the leakage location is indicated by calculating the matching probability under the multivariate Gaussian normal distribution.

[0017] As a further solution, the interconnected convolutional neural network includes: an input layer, a first convolutional layer, a second convolutional layer, a first fully connected layer, a second fully connected layer, an activation function layer, and an output layer; after each convolutional layer, a batch normalization layer and a maximum pooling layer are added in sequence;

[0018] The input layer consists of four trace segments, corresponding to the four coefficients in a byte of bit splicing. The leakage features of each trace segment are extracted through the first and second convolutional layers. The leakage features are sequentially mapped through the first and second fully connected layers to obtain features with labeled categories. The features are input into the activation function to obtain the predicted probability distribution of each category.

[0019] As a further solution, the leakage features are mapped sequentially through the first fully connected layer and the second fully connected layer. The specific process is as follows:

[0020] Leakage characteristics They are mapped into features through the first fully connected layer ;

[0021] feature They are mapped into features through the second fully connected layer ;

[0022] Among them, the characteristics It contains both the characteristics of its own coefficient and the characteristics of the first coefficient ,feature Contains the characteristics of its own coefficient and the characteristics of the second coefficient , It contains the characteristics of its own coefficient and the characteristics of the third coefficient .

[0023] As a further solution, the target algorithm is the polynomial sampling module in the SEAL-Embedded library, and the vulnerabilities of the sampling coefficients include: value leakage before modulo 3 reduction, 2-bit value leakage, and byte Hamming weight leakage.

[0024] Among them, for 2-bit value leakage and byte Hamming weight leakage, the trained interconnected convolutional neural network is used to classify the input traces respectively;

[0025] For value leakage before modulo 3 reduction, the trained convolutional neural network is used to classify the traces.

[0026] As a further solution, the factor graph of the target algorithm is specifically:

[0027] The four coefficients leaked by the 2-bit value, the Hamming weight of the byte, and the value before modulo 3 reduction are used as variable nodes, and the posterior distribution corresponding to each variable node is used as the factor node. When the factor node depends on the variable node, they are connected by edges.

[0028] In other embodiments, the following technical solutions are adopted:

[0029] A side channel analysis system for CKKS embedded implementation, including:

[0030] a trace acquisition module configured to acquire electromagnetic traces when the CKKS embedded device executes a target algorithm;

[0031] a leakage location identification module configured to construct a template based on the acquired electromagnetic traces and the operation being performed at the leakage location, thereby locating the leakage location and identifying the leakage location;

[0032] a class prediction module configured to input the electromagnetic traces identifying the leak location into a trained interconnected convolutional neural network to obtain a predicted probability distribution for each class, thereby obtaining a predicted leak class; wherein the interconnected convolutional neural network takes four trace segments as input at a time, and the features of the four trace segments correspond to the four coefficients in the bit-spliced ​​byte respectively;

[0033] The category optimization module is configured to construct a factor graph for the target algorithm, integrates the relationship between multiple leakage information through the belief propagation algorithm, optimizes the predicted classification results, and obtains the optimized leakage category.

[0034] In other embodiments, the following technical solutions are adopted:

[0035] A terminal device includes a processor and a memory, wherein the processor is used to implement instructions; the memory is used to store multiple instructions, wherein the instructions are suitable for the processor to load and execute the above-mentioned high-precision battery model parameter identification method based on output response reconstruction.

[0036] In other embodiments, the following technical solutions are adopted:

[0037] A computer-readable storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor of a terminal device and executing the above-mentioned high-precision battery model parameter identification method based on output response reconstruction.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] (1) The present invention locates the leakage location based on the operation-based template, distinguishes specific operations, and can perform pattern matching in the entire trace to identify all leakage locations corresponding to the target operation.

[0040] (2) The present invention designs an interconnected convolutional neural network based on the leakage characteristics of bit splicing. There is a connection between the leakage characteristics of the four coefficients in each byte in bit splicing, and each coefficient always depends on the previous coefficient for splicing. The interconnected convolutional neural network of the present invention inputs the energy consumption traces corresponding to the four coefficients in each byte and splices the characteristics of the previous traces in the fully connected layer. This operation simulates bit splicing, allowing the model to focus on the leakage characteristics of the previous traces during classification, thereby improving the classification accuracy.

[0041] (3) Due to the characteristics of rejection sampling and bit splicing, leakage does not only occur during the sampling of the 2-bit coefficients in each round. By constructing a factor graph of the target algorithm and establishing the relationship between various leakage information through the factor graph, the present invention can comprehensively characterize the leakage of the polynomial sampling module of the SEAL-Embedded library from multiple angles, thereby achieving higher accuracy in side-channel analysis.

[0042] Other features and advantages of additional aspects of the present invention will be given in part in the following description and in part will become obvious from the following description or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a flow chart of a side channel analysis method for CKKS embedded implementation in an embodiment of the present invention;

[0044] Figure 2 Schematic diagram of leakage location based on operation in an embodiment of the present invention;

[0045] Figure 3 Schematic diagram of the interconnected convolutional neural network structure in an embodiment of the present invention;

[0046] Figure 4 A factor graph constructed according to leakage in rejection sampling in an embodiment of the present invention;

[0047] Figure 5 The following is a comparison of the accuracy and loss of ICNN and CNN in an embodiment of the present invention; (a) is the accuracy comparison, and (b) is the loss comparison;

[0048] Figure 6 Graph showing changes in information entropy during belief propagation in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] It should be noted that the following detailed description is illustrative and is intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used in the present invention have the same meaning as commonly understood by those skilled in the art to which the present invention belongs.

[0050] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0051] Example 1

[0052] This embodiment uses the polynomial sampling module in the SEAL-Embedded library as the target algorithm to be executed.

[0053] Specifically, the SEAL-Embedded library provides a polynomial sampling module to obtain random values. In the symmetric and asymmetric encryption process, the private key sk and encrypted samples u It is from R 3({−1, 0, 1}), and the polynomial sampling module is implemented by rejection sampling and modulo 3 reduction.

[0054] The polynomial sampling module is implemented as the sample_small_poly_ternary_prng_96 function, which first generates a random byte by rejecting the sample. If the sample value is not in the valid range, it will recycle the sample. If the sample value is valid, it will be mapped to R 3({−1, 0, 1}), which is mapped to a value in {−1, 0, 1}. Then, it stores the triplet in an array through the set_small_poly_idx function.

[0055] In the SEAL-Embedded library, sampling results are bit-concatenated to reduce storage overhead. Specifically, when the polynomial sampling module samples the key, it generates 2-bit key coefficients at a time. Each four key coefficients are then bit-concatenated into an 8-bit number, or one byte. Therefore, bit-concatenation allows for more compact storage of sampling results, reducing storage overhead.

[0056] This implementation has two vulnerabilities that can be exploited:

[0057] The first vulnerability is that rand_val stores the bytes after rejected sampling. This vulnerability provides information about the coefficient values ​​before modulo 3 reduction.

[0058] The second vulnerability is the bit-splicing operation on the sampled 2-bit coefficients, which may not only leak the value information of the 2-bit coefficients, but also leak the Hamming weight information after splicing multiple coefficients.

[0059] Therefore, this embodiment uses the polynomial sampling module in the SEAL-Embedded library as the target algorithm for side channel analysis.

[0060] Based on this, in one or more embodiments, a side channel analysis method for CKKS embedded implementation is disclosed, combined with Figure 1 The specific process includes:

[0061] S101: Acquire electromagnetic traces when the CKKS embedded device executes the target algorithm.

[0062] As a specific implementation, this example uses the STM32F407G-DISC1 development board, which contains a 32-bit ARM Cortex-M4 STM32F407G microcontroller and is widely used in IoT devices, to run the CKKS algorithm from the SEAL-Embedded library. Furthermore, a digital oscilloscope (DSOX3024T) and a Langer RF2 near-field probe were used to record the microcontroller's electromagnetic traces. A PA303 amplifier was used for signal preprocessing. Measurements were performed at a sampling rate of 500 MSa / s and a bandwidth limit of 200 MHz.

[0063] S102: For the acquired electromagnetic trace, a template is constructed based on the operation being performed to locate the leakage position and identify the leakage position.

[0064] Since rejection sampling only filters the sample values ​​within the valid range, not every sampling result will be stored, which results in uneven sampling time intervals for each coefficient.

[0065] To analyze the vulnerability in rejection sampling, it is necessary to identify the leakage location of each coefficient in the trace. This embodiment uses the operation being performed at the leakage location as the target operation, and constructs a template based on the target operation to locate the leakage location and identify the leakage location. The specific process is as follows:

[0066] First, the leakage characteristics of the target operation are analyzed to obtain the energy consumption trace corresponding to each operation value of the target operation. Then, the mean and covariance matrix of these energy consumption traces are calculated to obtain the template of the leakage location.

[0067] The calculation formulas for the mean and covariance matrix are as follows:

[0068] ;

[0069] ;

[0070] in, is the mean, is the covariance matrix, Indicates the number of traces, Indicates the i Trace lines.

[0071] Then, the template is used to match the complete trace. When a similar trace segment is found, it is marked. The marked trace is the leakage location.

[0072] Specifically, a sliding window is used to perform template matching on the entire trace segment by segment, and the leakage location is indicated by the matching probability under the multivariate Gaussian normal distribution.

[0073] The matching probability formula under the multivariate Gaussian normal distribution is as follows:

[0074] ;

[0075] in, is the target location, express ; Indicates the matching probability between the template and the trace in the sliding window. This embodiment sets a threshold. When the matching probability is greater than the threshold, it means that the match is successful. The value of the threshold can be adjusted according to actual conditions. Indicates the target location The dimension of The number of points included. In addition, in the formula, The dimension is also , The dimension is .

[0076] As a specific example, if the location where a 2-bit coefficient is leaking is performing a modulo-3 calculation on rand_val, the location of the modulo-3 calculation needs to be identified. Specifically, a template is constructed for the modulo-3 calculation, which is the energy consumption trace of the modulo-3 calculation. This template is then used to match the complete trace. When similar trace segments are found, they are marked. The marked trace is the location of the 2-bit coefficient leakage.

[0077] Traditional templates distinguish leak locations based on data. However, the polynomial sampling module uses rejection sampling. Rejection sampling evaluates the sampling results after random sampling. If the results do not meet the requirements, they are discarded and resampled. Therefore, not every sampling result is output, and the data-based leakage location distinction method has a large error.

[0078] To find the actual output result, this embodiment models the target operation, enabling pattern matching across the entire trace to identify all leak locations corresponding to the target operation. For example, when a modulo-3 operation occurs, the sampling module outputs a 2-bit coefficient, which prevents the location of an unqualified sampling result.

[0079] Figure 2 An example of an operation-based leak location method is given, specifically the Hamming weight leak location of the coefficients. Figure 2 There are four correlation peaks in the lower half of the graph, which represent the occurrence of target operations. The leakage locations are delineated near the target operations. Figure 2 The red dotted lines in the upper part of the image mark four intervals, which are the leakage locations.

[0080] S103: Input the electromagnetic traces that identify the leakage location into the trained interconnected convolutional neural network to obtain the predicted probability distribution of each category. The index corresponding to the maximum probability is the category of the leakage information predicted by the model.

[0081] Different classification targets involve different types of leaked information. In this embodiment, there are three types of sampling coefficient vulnerabilities (i.e., three classification targets): value leakage before modulo-3 reduction (denoted as rand_val), 2-bit value leakage (denoted as 2-bits), and byte Hamming weight leakage (denoted as HW).

[0082] For a rand_val leak, it represents the result of random sampling between 0 and 255, resulting in 256 possible categories: {0, 1, ..., 255}. For a 2-bits leak, each value corresponds to a coefficient in the secret polynomial. Due to the ternary nature of each coefficient, it has three possible categories: {00, 01, 10}. For an HW leak, it represents the Hamming weight of the 8-bit value after bit splicing. The HW label is formed by splicing four ternary values, resulting in five possible categories: {0, 1, 2, 3, 4}.

[0083] During sampling, bit splicing stores every four coefficients in a single byte. For 2-bits and HW, the leakage characteristics of the four coefficients in each byte are different, while coefficients in the same position in different bytes have similar leakage characteristics. Therefore, all coefficients can be divided into four types: Type 1, Type 2, Type 3, and Type 4, representing the first, second, third, and fourth 2-bit coefficients in each byte, respectively.

[0084] In order to analyze the leakage characteristics caused by bit splicing, this embodiment designs an interconnected convolutional neural network (ICNN) to learn the leakage characteristics of the continuous intervals in the four coefficients. Figure 3 The ICNN consists of two convolutional layers and three fully connected layers, with classification finally performed via the SoftMax function. After each convolutional layer, a BatchNorm layer and a MaxPooling layer are added in sequence. In addition, the SeLU activation function is applied after each layer to avoid the vanishing and exploding gradient problems.

[0085] Specifically, ICNN accepts four trace segments each time As input, they correspond to four coefficients in a byte and their features are extracted through two convolutional layers. The leakage features of these trace segments are represented as ,in Represents the feature dimension.

[0086] These features are then fed into the first fully connected layer and mapped to ,in Represents the new feature dimension.

[0087] Then, it is mapped to ;

[0088] The features and features Splicing to get the spliced ​​features , the spliced ​​features Mapped into the second fully connected layer ;

[0089] The features and features Splicing to get the spliced ​​features , the spliced ​​features Mapped into the second fully connected layer ;

[0090] feature and features Splicing to get the spliced ​​features , the spliced ​​features Mapped into the second fully connected layer ;

[0091] After the fusion of two fully connected layers, and All contain the characteristics of themselves and the previous coefficient. Finally, we get They are mapped to the label category dimension and input into the SoftMax function to obtain the predicted probability distribution for each category.

[0092] To perform 2-bits and HW classification tasks, the categorical cross entropy function is used as the loss function. The trace of the correct label is recorded as , the model's predicted probability of the sample belonging to each category is recorded as , the number of categories is recorded as The loss function is defined as:

[0093] ;

[0094] in, Indicates that the correct sample belongs to The probability of the class, and The model predicts that the sample belongs to The number of traces in each batch is recorded as , Indicates the first The overall loss function is expressed as:

[0095] .

[0096] For rand_val, since it does not require bit splicing, this example uses a standard convolutional neural network (CNN) to classify its electromagnetic traces. This model also consists of two convolutional layers and three fully connected layers. After each convolutional layer, a BatchNorm layer and an AveragePooling layer are added. Finally, classification is performed using the SoftMax function, and the categorical cross entropy function is used as the loss function.

[0097] Compared with ordinary CNNs, the ICNN proposed in this embodiment has four traces as input, which correspond to the four coefficients in bit splicing. At the same time, the ICNN performs splicing in the fully connected layer, splicing the features of the previous trace into each trace, simulating bit splicing, so that the model can focus on the leakage features of the previous trace during classification.

[0098] S104: Construct a factor graph of the target algorithm, integrate the relationships between multiple leakage information through the belief propagation algorithm, optimize the predicted classification results, and obtain the optimized leakage category.

[0099] Because the 2-bit coefficient is the key coefficient, its classification accuracy directly reflects the intensity of the leakage. Therefore, the main goal of this step is to optimize the leakage category classification result of the 2-bit coefficient.

[0100] In this embodiment, the probability distribution output by the interconnected convolutional neural network in step S103 is input to the factor graph as the initial probability distribution in the factor graph, and is subsequently further updated by belief propagation.

[0101] This embodiment uses the belief propagation algorithm to further optimize the probability distribution of the 2-bit coefficients by leveraging the relationship between the three types of leakage. Therefore, the final analysis result is still a probability distribution. By selecting the index corresponding to the maximum probability, the final classification category is obtained: one of {00, 01, 10}. Compared to the probability distribution output by the ICNN, the belief propagation algorithm achieves higher classification accuracy.

[0102] To jointly exploit the leaked information from the 2-bits, HW, and rand_val vulnerabilities, this example constructs a factor graph corresponding to rejected sampling. When analyzing side-channel leaks, it's often useful to construct a factor graph for the target encryption algorithm to model the relationships between intermediate variables. A factor graph consists of a variable node for each variable and a factor node for each function, connecting variable nodes when they serve as parameters to factor nodes.

[0103] Based on these rules, the arithmetic relationship between leakage can be constructed using factor graphs. When factor nodes (represented by rectangles) depend on variable nodes (represented by circles), they are connected by edges. The factor graph corresponding to rejection sampling is as follows Figure 4 shown; among them, f hw 、 f mod3 Indicates the relationship between the two variables being connected. f hw The 2-bit value and HW are connected, which means that HW can be obtained by calculating the Hamming weight of four 2-bit values. f mod3 The 2-bit value and the value before modulo 3 reduction are connected, which means that the 2-bit value can be obtained by performing modulo 3 calculation on the value before modulo 3 reduction.

[0104] HW variables (Hamming weight of new_val) can be obtained from the four 2-bit coefficients (The value of val_in) is derived.

[0105] In addition, the rand_val variable (The value of rand_val) is connected to the 2-bit variable through a modular operation. The posterior distribution of these variables provided by the aforementioned neural network analysis is added as a function node, for example, Corresponding to The posterior distribution of .

[0106] The factor graph is fed into belief propagation, which propagates information to determine the marginal probability distribution of the coefficients. Message passing involves both from variables to factors and from factors to variables, following the computational rules. The specific process is as follows:

[0107] Before belief propagation, the probability distribution of each variable node in the factor graph is initialized, and then the belief propagation calculation can begin. During the belief propagation process, there are two propagation directions: from variables to factors and from factors to variables:

[0108] (1) From variables to factors: Each variable node calculates a message based on information from adjacent nodes and then sends the message to the connected factor node. The message here is a combination of the current probability distribution of the variable and messages from other factor nodes.

[0109] (2) From factors to variables: Each factor node receives messages from all adjacent variable nodes and computes messages to send to each variable node. These messages are usually based on the product of the factor potential function and the received variable messages.

[0110] Repeat the above message passing and updating steps until the message converges.

[0111] Finally, the coefficient is determined by iteratively performing the message propagation calculation The marginal probability of .

[0112] coefficient The marginal probability of is the final probability distribution. At this point, each trace will get a probability distribution, and by selecting the index corresponding to the maximum probability, we can get the final category of each coefficient, that is, the classification is one of {00, 01, 10}.

[0113] At this point, you can observe the classification accuracy. If the classification accuracy is very high, it means that the side channel leakage in this part is obvious.

[0114] To demonstrate the effectiveness of the ICNN in this example, we compared it with a CNN model widely used for side channel analysis based on deep learning. The same parameter settings were used for both CNN and ICNN. The comparison of verification accuracy and loss after each cycle of training is shown in the figure below. Figure 5 As shown in (a) and (b), Figure 5 (a) is the accuracy comparison chart. Figure 5(b) in the figure is a loss comparison chart; the red line represents the metrics of the ICNN, while the blue line represents the metrics of the CNN. With the increase in epochs, the ICNN achieved higher accuracy and lower loss. After 50 epochs of training, the ICNN achieved an average classification accuracy of 91.8% on 2-bit labels and 88.5% on HW labels. In comparison, the CNN achieved an average classification accuracy of 85.6% on 2-bit labels and 87.1% on HW labels. Therefore, compared with the CNN, the ICNN better adapts to the leakage characteristics of bit splicing. In addition, the classification accuracy of rand_val using the CNN reached 76.8%, which will be used in the subsequent belief propagation algorithm.

[0115] After obtaining the 2-bits, HW and rand_val probability distributions of the SoftMax output, we use Figure 4 The designed factor graph integrates their probability distributions and uses belief propagation to update these probability distributions. 10 rounds of belief propagation iterations are performed, and information entropy is used to represent the uncertainty of the probability distribution. Figure 6 The figure shows the change in information entropy of the 2-bit probability distribution after each belief propagation iteration. Darker areas indicate higher entropy values, representing greater uncertainty, while lighter areas indicate lower entropy values, representing less uncertainty. It can be observed that in the initial probability distribution, the target coefficient has higher information entropy, resulting in a lower attack success rate. As the number of belief propagation iterations increases, the information entropy of the probability distribution gradually decreases. Ultimately, the entropy values ​​of the four probability distributions approach 0.

[0116] Table 1 gives the comparative data of different types of analysis accuracy using a single trace.

[0117] Table 1 Comparison of analysis accuracy using a single trace

[0118]

[0119] Finally, Table 1 shows the analysis accuracy of different methods when using a single trace. The average accuracy using CNN is 85.6%, and the average accuracy using ICNN is 91.8%. Compared with CNN, ICNN captures the leakage characteristics of bit splicing, thereby significantly improving the analysis accuracy of the latter three types of traces. After integrating these three types of leakage information using belief propagation, the average accuracy further increased to 99.2%. Therefore, the method proposed in this solution can analyze leaks in the SEAL-Embedded library with higher accuracy and evaluate the threat level of its leaks to security with higher standards. In addition, since the analysis object in this embodiment is bit splicing technology, the proposed method can be applied to various implementations of memory compression using bit splicing under resource-constrained conditions, and is not limited to the SEAL-Embedded library.

[0120] Example 2

[0121] In one or more embodiments, a side channel analysis system for CKKS embedded implementation is disclosed, specifically including:

[0122] a trace acquisition module configured to acquire electromagnetic traces when the CKKS embedded device executes a target algorithm;

[0123] a leakage location identification module configured to construct a template based on the acquired electromagnetic traces and the operation being performed at the leakage location, thereby locating the leakage location and identifying the leakage location;

[0124] a class prediction module configured to input the electromagnetic traces identifying the leak location into a trained interconnected convolutional neural network to obtain a predicted probability distribution for each class, thereby obtaining a predicted leak class; wherein the interconnected convolutional neural network takes four trace segments as input at a time, and the features of the four trace segments correspond to the four coefficients in the bit-spliced ​​byte respectively;

[0125] The category optimization module is configured to construct a factor graph for the target algorithm, integrates the relationship between multiple leakage information through the belief propagation algorithm, optimizes the predicted classification results, and obtains the optimized leakage category.

[0126] It should be noted that the specific implementation of the above modules is exactly the same as that in Example 1 and will not be described in detail.

[0127] Example 3

[0128] In one or more embodiments, a terminal device is disclosed, which includes a processor and a memory, wherein the processor is used to implement instructions; the memory is used to store multiple instructions, and the instructions are suitable for being loaded and executed by the processor for the side channel analysis method for CKKS embedded implementation described in Example 1.

[0129] It should be understood that in this embodiment, the processor may be a central processing unit (CPU), or may be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), off-the-shelf field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0130] The memory may include a read-only memory and a random access memory, and provides instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory may also store information about the device type.

[0131] During implementation, each step of the above method may be completed by an integrated logic circuit of hardware in a processor or by instructions in the form of software.

[0132] Example 4

[0133] In one or more embodiments, a computer-readable storage medium is disclosed, storing a plurality of instructions, wherein the instructions are suitable for being loaded and executed by a processor of a terminal device for the side channel analysis method for CKKS embedded implementation described in Example 1.

[0134] Although the above describes the specific embodiments of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without any creative work are still within the scope of protection of the present invention.

Claims

1. A side channel analysis method for CKKS embedded implementation, characterized in that: include: Obtain electromagnetic traces when the CKKS embedded device executes the target algorithm; For the acquired electromagnetic traces, a template is constructed based on the operation being performed to locate and identify the leak location; Inputting the electromagnetic traces that identify the leak location into a trained interconnected convolutional neural network to obtain a predicted probability distribution for each category, thereby obtaining the predicted leak category; wherein the interconnected convolutional neural network takes four trace segments as input at a time, and the features of the four trace segments correspond to the four coefficients in the bit-spliced ​​byte respectively; Construct a factor graph of the target algorithm, integrate the relationships between multiple leakage information through the belief propagation algorithm, optimize the predicted classification results, and obtain the optimized leakage category; The interconnected convolutional neural network includes: an input layer, a first convolutional layer, a second convolutional layer, a first fully connected layer, a second fully connected layer, an activation function layer, and an output layer; after each convolutional layer, a batch normalization layer and a maximum pooling layer are added in sequence; The input layer consists of four trace segments, corresponding to the four coefficients in a byte of bit splicing. The leakage features of each trace segment are extracted through the first and second convolutional layers. The leakage features are sequentially mapped through the first and second fully connected layers to obtain features with labeled categories. The features are input into the activation function to obtain the predicted probability distribution of each category.

2. A side channel analysis method for CKKS embedded implementation according to claim 1, characterized in that: For the acquired electromagnetic traces, a template is constructed based on the operation being performed to locate the leak. The specific process is as follows: The operation being performed at the leakage location is taken as the target operation, the energy consumption trace of the target operation is obtained, the mean and covariance matrix of the energy consumption trace are calculated, and a template corresponding to the target operation is obtained; A sliding window is used to perform template matching on the entire acquired electromagnetic trace in segments, and the leakage location is indicated by calculating the matching probability under the multivariate Gaussian normal distribution.

3. A side channel analysis method for CKKS embedded implementation according to claim 1, characterized in that: The leakage features are mapped sequentially through the first fully connected layer and the second fully connected layer. The specific process is as follows: Leakage characteristics They are mapped into features through the first fully connected layer ; feature They are mapped into features through the second fully connected layer ; Among them, the characteristics It contains both the characteristics of its own coefficient and the characteristics of the first coefficient ,feature Contains the characteristics of its own coefficient and the characteristics of the second coefficient , It contains the characteristics of its own coefficient and the characteristics of the third coefficient .

4. A side channel analysis method for CKKS embedded implementation according to claim 1, characterized in that: The target algorithm is the polynomial sampling module in the SEAL-Embedded library. The sampling coefficient vulnerabilities include: value leakage before modulo 3 reduction, 2-bit value leakage, and byte Hamming weight leakage.

5. A side channel analysis method for CKKS embedded implementation as claimed in claim 4, characterized in that: For 2-bit value leakage and byte Hamming weight leakage, the trained interconnected convolutional neural network is used to classify the input traces respectively; For value leakage before modulo 3 reduction, the trained convolutional neural network is used to classify the traces.

6. A side channel analysis method for CKKS embedded implementation according to claim 1, characterized in that: The factor graph of the target algorithm is specifically: The four coefficients leaked by the 2-bit value, the Hamming weight of the byte, and the value before modulo 3 reduction are used as variable nodes, and the posterior distribution corresponding to each variable node is used as the factor node. When the factor node depends on the variable node, they are connected by edges.

7. A side channel analysis system for CKKS embedded implementation, characterized in that: include: a trace acquisition module configured to acquire electromagnetic traces when the CKKS embedded device executes a target algorithm; a leakage location identification module configured to construct a template based on the acquired electromagnetic traces and the operation being performed at the leakage location, thereby locating the leakage location and identifying the leakage location; a class prediction module configured to input the electromagnetic traces identifying the leak location into a trained interconnected convolutional neural network to obtain a predicted probability distribution for each class, thereby obtaining a predicted leak class; wherein the interconnected convolutional neural network takes four trace segments as input at a time, and the features of the four trace segments correspond to the four coefficients in the bit-spliced ​​byte respectively; The category optimization module is configured to construct a factor graph for the target algorithm. It integrates the relationships between multiple leakage information through the belief propagation algorithm, optimizes the predicted classification results, and obtains the optimized leakage category. The interconnected convolutional neural network includes: an input layer, a first convolutional layer, a second convolutional layer, a first fully connected layer, a second fully connected layer, an activation function layer, and an output layer; after each convolutional layer, a batch normalization layer and a maximum pooling layer are added in sequence; The input layer consists of four trace segments, corresponding to the four coefficients in a byte of bit splicing. The leakage features of each trace segment are extracted through the first and second convolutional layers. The leakage features are sequentially mapped through the first and second fully connected layers to obtain features with labeled categories. The features are input into the activation function to obtain the predicted probability distribution of each category.

8. A terminal device comprising a processor and a memory, wherein the processor is used to implement instructions; the memory is used to store multiple instructions, characterized in that: The instructions are suitable for being loaded by a processor and executing the side channel analysis method for CKKS embedded implementation described in any one of claims 1-6.

9. A computer-readable storage medium storing a plurality of instructions, characterized in that: The instructions are suitable for being loaded by the processor of the terminal device and executing the side channel analysis method for CKKS embedded implementation described in any one of claims 1-6.

Images