Side channel attack method based on multi-label and multi-expert network

Abstract

The invention discloses a side channel attack method based on a multi-label and multi-expert network, and the method comprises the steps: firstly designing and constructing a three-dimensional multi-label matrix based on a binary label calculation method for a public original data set of a target cryptographic algorithm; secondly, designing a multi-expert network model based on an attention mechanism, comprising an input layer, an expert network layer, a sharing layer and an output layer, and realizing parallel recovery of all key bytes of the target cryptographic algorithm; and completing training through grid search, and finally completing side channel attack by using the trained model. According to the method, parallel recovery of all key bytes of the target cryptographic algorithm is completed through one-time model training, manual selection of interest point intervals is avoided, side channel attack complexity is reduced, and attack efficiency is improved; meanwhile, the learning ability of the model is improved through an attention mechanism, and the robustness of the model is improved through common learning of a sharing layer, so that the success rate of side channel attacks is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a side channel attack method based on a multi-label and multi-expert network. Background Art

[0002] A side-channel attack is an attack method that uses physical information leaked by a target device during the execution of a cryptographic algorithm to infer the system's internal state and subsequently recover sensitive data such as keys. Unlike traditional cryptanalysis methods, side-channel attacks do not directly target the cryptographic algorithm itself, but instead focus on side information leaked during the actual operation of the cryptographic algorithm on the hardware device, such as time, energy, and electromagnetic radiation. Currently, leveraging the powerful data processing and automated learning capabilities of deep learning, deep learning side-channel attacks have become a major research area in side-channel attacks.

[0003] However, existing deep learning side-channel attack methods mostly employ a divide-and-conquer strategy. To recover a single key byte, they typically need to manually select a range of points of interest, characterize the intermediate values with pre-leaked labels, and then train and test the model. To recover all key bytes of the cryptographic algorithm, these steps must be repeated. This approach is inefficient and expensive.

[0004] To solve the above problems, the present invention proposes a side channel attack method based on multi-label and multi-expert networks. First, a three-dimensional multi-label matrix is designed and constructed based on the binary label method [1]. Secondly, a multi-expert network model is designed, including an input layer, an expert network layer, a shared layer, and an output layer. Through one-time model training, all key bytes of the cryptographic algorithm are recovered in parallel, and the manual selection of interest point intervals is avoided, thereby reducing the complexity of the attack process and improving the efficiency of the attack.

[0005] References

[0006] [1]Zhang L, Summary of the Invention

[0007] In response to the problems of repeated modeling and the need to manually select interest point intervals in the divide-and-conquer approach commonly used in deep learning side channel attacks, the present invention proposes a side channel attack method based on multi-label and multi-expert networks. The method first designs and constructs a three-dimensional multi-label matrix based on a binary label characterization method for the public original data set of the target cryptographic algorithm; secondly, a multi-expert network model based on an attention mechanism is designed, including an input layer, an expert network layer, a sharing layer and an output layer, wherein the input layer takes the constructed three-dimensional multi-label matrix and energy trace matrix as input; the expert network layer is composed of multiple expert networks working in parallel, and each expert network uses the attention mechanism to adaptively learn and extract the important features of a key byte of the target cryptographic algorithm on the energy trace; the sharing layer fuses the features output by all expert networks to enhance the model's learning of common features; the output layer configures a corresponding output branch for each expert network to achieve parallel prediction of all key bytes of the target cryptographic algorithm.

[0008] The technical solution for achieving the purpose of the present invention is:

[0009] A side channel attack method based on a multi-label and multi-expert network, characterized by comprising the following steps:

[0010] (1) Obtain energy trace data;

[0011] To obtain energy trace data, we directly use the original energy trace dataset published by the target cryptographic algorithm and divide it into training and test sets.

[0012] (2) Design and construct a three-dimensional multi-label matrix;

[0013] First, a multi-label characterization of a single key byte of the target cryptographic algorithm is constructed based on the binary label calculation method. Then, a two-dimensional multi-label matrix is constructed for each energy trace. Finally, the multi-labels of all key bytes on all energy traces are combined to form a three-dimensional multi-label matrix.

[0014] (3) Design and build a multi-expert network model based on attention mechanism;

[0015] The multi-expert network model based on the attention mechanism includes an input layer, an expert network layer, a shared layer, and an output layer. The input layer receives input data. The expert network layer is composed of multiple expert networks, each of which uses the attention mechanism to learn and extract the characteristics of a key byte of the target cryptographic algorithm on the energy trace. The shared layer fuses the features output by all expert networks. The output layer realizes the parallel prediction of all key bytes of the target cryptographic algorithm.

[0016] (4) Multi-expert network model training based on attention mechanism;

[0017] Input the energy trace matrix of the training set and the corresponding multi-label matrix into the constructed model, find the best hyperparameter combination through grid search, complete the model training, and save it;

[0018] (5) Implement side channel attacks based on the trained multi-expert network model;

[0019] The trained multi-expert network model is tested on the test set. By analyzing the results of the model's parallel output, all key bytes of the target cryptographic algorithm are recovered to complete the side channel attack.

[0020] In the side channel attack method based on multi-label and multi-expert network of the present invention, step (1) is to obtain energy trace data, and the specific steps are as follows:

[0021] (1.1) Assume that the key of the target cryptographic algorithm contains K key bytes, and assume that there are N energy traces in the public raw energy trace data set of the target cryptographic algorithm, represented by T = {t1, t2, …, t i ,…,t N}, where t i represents the i-th energy trace, 1≤i≤N;

[0022] (1.2) The energy trace dataset T is divided into a training set containing n energy traces and a test set containing m energy traces, where n+m=N.

[0023] In the side channel attack method based on multi-label and multi-expert network of the present invention, step (2) is to design and construct a three-dimensional multi-label matrix, and the specific steps are as follows:

[0024] (2.1) Calculate the multi-label of a single key byte based on the binary label calculation method. Assume that the decimal median value of the jth key byte corresponding to the i-th energy trace in the training set is L i,j , L i,j =f(p i,j ,k i,j ), where p i,j and k i,j denotes the j-th byte value of the plaintext and key corresponding to the i-th energy trace, 1≤i≤n, 1≤j≤K; f(·) is an intermediate value calculation function; L i,j Converted to 8-bit binary label Y i,j ={Y i,j [b]|b=1,2,...,8},Y i,j [b] indicates label Y i,j The b-th sub-label in is calculated as follows, where Indicates rounding down:

[0025]

[0026] (2.2) According to the multi-label construction method in step (2.1), construct the binary labels of all key bytes of the i-th energy trace and splice them into a two-dimensional multi-label combination (Y i,1 ,Y i,2 ,…,Y i,j ,…,Y i,K );

[0027] (2.3) Based on the two-dimensional multi-label combination of all key bytes of an energy trace constructed in step (2.2), the label combinations of all key bytes corresponding to each of the n energy traces are concatenated to form a three-dimensional multi-label matrix H, as shown below:

[0028]

[0029] In the side channel attack method based on multi-label and multi-expert network of the present invention, step (3) is to design and construct a multi-expert network model based on the attention mechanism, and the specific steps are as follows:

[0030] (3.1) The multi-expert network model based on the attention mechanism includes an input layer, an expert network layer, a shared layer, and an output layer;

[0031] (3.2) Data preprocessing;

[0032] (3.2.1) In order to reduce the dimension of the data and eliminate the difference in the value range, all n original energy traces in the training set are resampled and reduced to reduce the number of time sample points in the energy trace to R. Then, each energy trace is normalized to the minimum and maximum values. The value t of the rth time sample point in the i-th energy trace is i [r] The minimum and maximum normalization processing method is as follows: 1≤i≤n, 1≤r≤R, and the value of the sample point after processing is t i '[r]:

[0033]

[0034] Where min(·) and max(·) represent the minimum and maximum values of the sample points in the i-th energy trace, respectively;

[0035] (3.2.2) Copy all processed energy traces K times and concatenate them into an energy trace matrix T' of shape n × K;

[0036] (3.3) Input the multi-label matrix H and the preprocessed energy trace matrix T' into the model, and complete the input of the above data through the input layer;

[0037] (3.4) Design and build the expert network layer;

[0038] (3.4.1) To learn and extract features corresponding to the K key bytes in the energy trace of the target cryptographic algorithm in parallel, K expert networks with identical structures and executed in parallel are constructed. Each expert network consists of a local connection layer, an LSTM layer, and an attention mechanism module. Each expert network learns and extracts features for the key bytes corresponding to the expert network based on the input energy trace matrix T' and the multi-label matrix H.

[0039] (3.4.2) The convolution kernel size of the local connection layer is 52, the number of filters is 1, and the stride is 13. It reduces the complexity of subsequent data processing by compressing the data dimension while retaining important features;

[0040] (3.4.3) The LSTM layer contains 128 neurons. The LSTM layer can selectively retain or discard features by controlling the forget gate and input gate, thereby capturing the dependencies between features compressed by the local fully connected layer at different time steps.

[0041] (3.4.4) To ensure that the model can extract valuable feature information and reduce the impact of noise, an attention mechanism module is added after the LSTM layer. This module consists of a fully connected layer with 1 neuron, a batch normalization layer, and a softmax layer. The fully connected layer generates a scalar score for each time step to help determine the importance of each time step. The batch normalization layer further normalizes the score, and finally the softmax layer outputs the final score for each time step. The final score is then weighted with the features output by the LSTM layer to selectively focus on the corresponding features.

[0042] (3.5) The shared layer consists of the Inception module, the Dropout layer, and the convolution block to achieve feature fusion;

[0043] (3.5.1) The Inception module consists of three one-dimensional convolutional layers in parallel. The convolution kernel size of each of the three convolutional layers is 4, and the number of filters is 1, 7, and 11 respectively. By splicing these three convolutional layers, feature extraction is further completed, thereby obtaining a richer feature representation.

[0044] (3.5.2) In the Dropout layer, the probability of random neuron inactivation is set to 20%. During each forward propagation, some neurons are randomly shut down so that they do not participate in the calculation. This prevents the model from being overly dependent on the training data, thereby effectively improving the generalization ability and robustness of the model.

[0045] (3.5.3) The convolution block consists of a convolutional layer, a normalization layer, and an average pooling layer, which is used to extract local features. The convolutional layer has a kernel size of 4 and a filter number of 1. The normalization layer is used to standardize the output of the convolutional layer to enhance the stability of the model. The window size and stride of the average pooling layer are both set to 2 to reduce the feature dimensionality and retain key information.

[0046] (3.6) Set K output branches with the same structure in the output layer, each branch includes 1 flattening layer and 3 fully connected layers;

[0047] (3.6.1) The function of the flattening layer is to convert the multi-dimensional feature tensor processed by the shared layer into a one-dimensional vector to facilitate further processing by the subsequent fully connected layer;

[0048] (3.6.2) Among the three fully connected layers, the first two fully connected layers contain 10 neurons each, and the SeLu activation function is used to alleviate the gradient explosion and gradient vanishing problems in the neural network. To meet the requirements of multi-label classification, the last fully connected layer is configured with 8 neurons, and the Sigmoid activation function is used to complete the output of the probability that each sub-label of the corresponding key byte is 1.

[0049] In the side channel attack method based on multi-label and multi-expert network of the present invention, step (4) is the multi-expert network model training based on the attention mechanism, and the specific steps are as follows:

[0050] (4.1) Input the energy trace matrix T' constructed in step (3.2) and the three-dimensional multi-label matrix H constructed in step (2) into the constructed multi-expert network model in a cyclic manner;

[0051] (4.2) Grid search was performed on different optimizers, learning rates, batch sizes, and epochs. Candidate optimizers included Adam, Adamax, RMSprop, Adadelta, and SGD; candidate learning rates were 0.01, 0.05, 0.001, 0.005, 0.0001, and 0.0005; candidate batch sizes were 32, 64, 128, and 256; and candidate epochs were 50, 100, 150, 200, 250, and 300. The above candidates were combined to form 720 hyperparameter combinations to form a grid search space.

[0052] (4.3) Traverse the above grid search space, train the model with different hyperparameter combinations, and save the corresponding trained model.

[0053] In the side channel attack method based on multi-label and multi-expert network of the present invention, step (5) is to implement the side channel attack based on the trained multi-expert network model, and the specific steps are as follows:

[0054] (5.1) For the test set containing m energy traces, resample and reduce the dimension according to the method in step (3.2.1), and perform minimum and maximum value normalization processing respectively to obtain the preprocessed energy trace data;

[0055] (5.2) Copy all processed energy traces K times and concatenate them into an energy trace matrix T' with a shape of m × K;

[0056] (5.3) Input the energy trace matrix T″ into the multi-expert network model trained in step (4) in sequence;

[0057] (5.4) In each multi-expert network model, calculate the best candidate key for all key bytes of the target cryptographic algorithm;

[0058] (5.4.1) For the sth test energy trace t after preprocessing s ”, 1≤s≤m, on the jth key byte, let the candidate key k * is the random variable K * The value of k * ∈[0,255], 1≤j≤K; Based on the output of the model, the candidate key k is calculated * The predicted probability is P j (K * =k * |t s ”);

[0059] (5.4.2) Using the cumulative method, calculate the sum of the probabilities of the j-th key byte corresponding to k* on all test energy traces, and obtain the best candidate key for the j-th key byte through maximum likelihood estimation The calculation method is:

[0060]

[0061] (5.4.3) Calculate the best candidate key for each of the K key bytes of the target cryptographic algorithm using the methods in steps (5.4.1) and (5.4.2);

[0062] (5.5) Repeat step (5.4) on all saved models and calculate the best candidate key corresponding to each model;

[0063] (5.6) The minimum number of energy traces required for each model to calculate the best candidate key is used as the evaluation metric. The results of all models obtained in step (5.5) on the test set are compared to determine the optimal model. The hyperparameter combination corresponding to the model is used as the optimal hyperparameter combination to complete the side channel attack.

[0064] The beneficial effects of the present invention are:

[0065] (1) The method of the present invention completes the definition of multiple labels based on the binary label method, making the distribution of labels more balanced, avoiding the situation where model training falls into category imbalance, and improving the performance of the model to a certain extent; on this basis, a three-dimensional multi-label matrix containing the labels corresponding to K key bytes of the target cryptographic algorithm is constructed. In the model input layer, the three-dimensional multi-label matrix and the preprocessed energy trace matrix are input into the multi-expert network model for parallel learning, avoiding manual selection of interest point intervals and reducing the complexity of side channel attacks;

[0066] (2) The multi-expert network model based on the attention mechanism proposed in the present invention automatically completes the parallel learning and key recovery of all key bytes of the target cryptographic algorithm based on the input multi-label matrix and energy trace matrix through the multi-expert network of the expert network layer and the multi-output branch of the output layer. The parallel recovery of all K key bytes of the target cryptographic algorithm is completed through one-time model training, avoiding the repeated operations of model training and key recovery, improving the efficiency of side channel attacks, and reducing the complexity of side channel attacks.

[0067] (3) The side channel attack method based on multi-label and multi-expert networks proposed in this invention improves the learning ability of the model through the attention mechanism, and enhances the model's learning of common features through the shared layer, thereby improving the robustness of the model, ultimately increasing the success rate of side channel attacks and reducing the number of energy traces required to recover the overall key of the target cryptographic algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 This is a flow chart of a side channel attack method based on multi-label and multi-expert networks in the present invention.

[0069] Specific implementation examples

[0070] The present invention will be further described in detail below with reference to the embodiments and drawings, but the present invention is not limited thereto. Example

[0071] A side channel attack method based on multi-label and multi-expert network, referring to Figure 1 , including the following steps:

[0072] (1) Obtain energy trace data;

[0073] (2) Design and construct a three-dimensional multi-label matrix;

[0074] (3) Design and build a multi-expert network model based on attention mechanism;

[0075] (4) Multi-expert network model training based on attention mechanism;

[0076] (5) Implement side channel attacks based on the trained multi-expert network model;

[0077] In the side channel attack method based on multi-label and multi-expert network of the present invention, step (1) is to obtain energy trace data, and the specific steps are as follows:

[0078] (1.1) The AES-128 cryptographic algorithm is used as the target cryptographic algorithm. The algorithm contains 16 key bytes, and K is set to 16. The existing public dataset ASCADv1 is used. This dataset collects the power consumption information of the AES-128 cryptographic algorithm on hardware devices and contains a total of N energy traces, represented by T = {t1, t2, …, t i ,…,t N}, where N = 60000, t i represents the i-th energy trace, 1≤i≤N;

[0079] (1.2) The energy trace dataset T is divided into a training set containing n energy traces and a test set containing m energy traces, where n = 50,000 and m = 10,000.

[0080] In the side channel attack method based on multi-label and multi-expert network of the present invention, step (2) is to design and construct a three-dimensional multi-label matrix, and the specific steps are as follows:

[0081] (2.1) Calculate the multi-label of a single key byte based on the binary label calculation method. Assume that the decimal median value of the jth key byte corresponding to the i-th energy trace in the training set is L i,j , L i,j =f(p i,j ,k i,j ), where p i,j and k i,j denotes the j-th byte value of the plaintext and key corresponding to the i-th energy trace, 1≤i≤n, 1≤j≤K; f(·) is an intermediate value calculation function; L i,j Converted to 8-bit binary label Y i,j ={Y i,j [b]|b=1,2,...,8},Y i,j [b] indicates label Y i,j The b-th sub-label in is calculated as follows, where Indicates rounding down:

[0082]

[0083] (2.2) According to the multi-label construction method in step (2.1), construct the binary labels of all key bytes of the i-th energy trace and splice them into a two-dimensional multi-label combination (Y i,1 ,Y i,2 ,…,Y i,j ,…,Y i,K );

[0084] (2.3) Based on the two-dimensional multi-label combination of all key bytes of an energy trace constructed in step (2.2), the label combinations of all key bytes corresponding to each of the n energy traces are concatenated to form a three-dimensional multi-label matrix H, as shown below:

[0085]

[0086] In the side channel attack method based on multi-label and multi-expert network of the present invention, step (3) is to design and construct a multi-expert network model based on the attention mechanism, and the specific steps are as follows:

[0087] (3.1) The multi-expert network model based on the attention mechanism includes an input layer, an expert network layer, a shared layer, and an output layer;

[0088] (3.2) Data preprocessing;

[0089] (3.2.1) In order to reduce the dimensionality of the data and eliminate the difference in the numerical range, all n original energy traces in the training set are resampled and reduced to reduce the number of time sample points in the energy trace to R, where R = 10000; then each energy trace is normalized to the minimum and maximum values, where the value t of the rth time sample point in the i-th energy trace is i [r] The minimum and maximum normalization processing method is as follows: 1≤i≤n, 1≤r≤R, and the value of the sample point after processing is t i '[r]:

[0090]

[0091] Where min(·) and max(·) represent the minimum and maximum values of the sample points in the i-th energy trace, respectively;

[0092] (3.2.2) Copy all processed energy traces K times and concatenate them into an energy trace matrix T' of shape n × K;

[0093] (3.3) Input the multi-label matrix H and the preprocessed energy trace matrix T' into the model, and complete the input of the above data through the input layer;

[0094] (3.4) Design and build the expert network layer;

[0095] (3.4.1) To learn and extract features corresponding to K key bytes corresponding to energy traces in the public dataset ASCADv1 in parallel, K expert networks with identical structures and executed in parallel are constructed. Each expert network consists of a local connection layer, an LSTM layer, and an attention mechanism module. Each expert network learns and extracts features for the key bytes corresponding to the expert network based on the input energy trace matrix T' and the multi-label matrix H.

[0096] (3.4.2) The convolution kernel size of the local connection layer is 52, the number of filters is 1, and the stride is 13. It reduces the complexity of subsequent data processing by compressing the data dimension while retaining important features;

[0097] (3.4.3) The LSTM layer contains 128 neurons. The LSTM layer can selectively retain or discard features by controlling the forget gate and input gate, thereby capturing the dependencies between features compressed by the local fully connected layer at different time steps.

[0098] (3.4.4) To ensure that the model can extract valuable feature information and reduce the impact of noise, an attention mechanism module is added after the LSTM layer. This module consists of a fully connected layer with 1 neuron, a batch normalization layer, and a softmax layer. The fully connected layer generates a scalar score for each time step to help determine the importance of each time step. The batch normalization layer further normalizes the score, and finally the softmax layer outputs the final score for each time step. The final score is then weighted with the features output by the LSTM layer to selectively focus on the corresponding features.

[0099] (3.5) The shared layer consists of the Inception module, the Dropout layer, and the convolution block to achieve feature fusion;

[0100] (3.5.1) The Inception module consists of three one-dimensional convolutional layers in parallel. The convolution kernel size of each of the three convolutional layers is 4, and the number of filters is 1, 7, and 11 respectively. By splicing these three convolutional layers, feature extraction is further completed, thereby obtaining a richer feature representation.

[0101] (3.5.2) In the Dropout layer, the probability of random neuron inactivation is set to 20%. During each forward propagation, some neurons are randomly shut down so that they do not participate in the calculation. This prevents the model from being overly dependent on the training data, thereby effectively improving the generalization ability and robustness of the model.

[0102] (3.5.3) The convolution block consists of a convolutional layer, a normalization layer, and an average pooling layer, which is used to extract local features. The convolutional layer has a kernel size of 4 and a filter number of 1. The normalization layer is used to standardize the output of the convolutional layer to enhance the stability of the model. The window size and stride of the average pooling layer are both set to 2 to reduce the feature dimensionality and retain key information.

[0103] (3.6) Set K output branches with the same structure in the output layer, each branch includes 1 flattening layer and 3 fully connected layers;

[0104] (3.6.1) The function of the flattening layer is to convert the multi-dimensional feature tensor processed by the shared layer into a one-dimensional vector to facilitate further processing by the subsequent fully connected layer;

[0105] (3.6.2) Among the three fully connected layers, the first two fully connected layers contain 10 neurons each, and the SeLu activation function is used to alleviate the gradient explosion and gradient vanishing problems in the neural network. To meet the requirements of multi-label classification, the last fully connected layer is configured with 8 neurons, and the Sigmoid activation function is used to complete the output of the probability that each sub-label of the corresponding key byte is 1.

[0106] In the side channel attack method based on multi-label and multi-expert network of the present invention, step (4) is the multi-expert network model training based on the attention mechanism, and the specific steps are as follows:

[0107] (4.1) Input the energy trace matrix T' constructed in step (3.2) and the three-dimensional multi-label matrix H constructed in step (2) into the constructed multi-expert network model in a cyclic manner;

[0108] (4.2) Grid search was performed on different optimizers, learning rates, batch sizes, and epochs. Candidate optimizers included Adam, Adamax, RMSprop, Adadelta, and SGD; candidate learning rates were 0.01, 0.05, 0.001, 0.005, 0.0001, and 0.0005; candidate batch sizes were 32, 64, 128, and 256; and candidate epochs were 50, 100, 150, 200, 250, and 300. The above candidates were combined to form 720 hyperparameter combinations to form a grid search space.

[0109] (4.3) Traverse the above grid search space, train the model with different hyperparameter combinations, and save the corresponding trained model.

[0110] In the side channel attack method based on multi-label and multi-expert network of the present invention, step (5) is to implement the side channel attack based on the trained multi-expert network model, and the specific steps are as follows:

[0111] (5.1) For the test set containing m energy traces, resample and reduce the dimension according to the method in step (3.2.1), and perform minimum and maximum value normalization processing respectively to obtain the preprocessed energy trace data;

[0112] (5.2) Copy all processed energy traces K times and concatenate them into an energy trace matrix T' with a shape of m × K;

[0113] (5.3) Input the energy trace matrix T″ into the multi-expert network model trained in step (4) in sequence;

[0114] (5.4) In each multi-expert network model, calculate the best candidate key for all key bytes of the target cryptographic algorithm;

[0115] (5.4.1) For the sth test energy trace t after preprocessing s ”, 1≤s≤m, on the jth key byte, let the candidate key k * is the random variable K * The value of k * ∈[0,255], 1≤j≤K; Based on the output of the model, the candidate key k is calculated * The predicted probability is P j (K * =k * |t s ”);

[0116] (5.4.2) Using the cumulative method, calculate the sum of the probabilities of the j-th key byte corresponding to k* on all test energy traces, and obtain the best candidate key for the j-th key byte through maximum likelihood estimation The calculation method is:

[0117]

[0118] (5.4.3) Calculate the best candidate key for each of the K key bytes of the target cryptographic algorithm using the methods in steps (5.4.1) and (5.4.2);

[0119] (5.5) Repeat step (5.4) on all saved models and calculate the best candidate key corresponding to each model;

[0120] (5.6) The minimum number of energy traces required for each model to calculate the best candidate key is used as the evaluation metric. The results of all models obtained in step (5.5) on the test set are compared to determine the optimal model. The hyperparameter combination corresponding to the model is used as the optimal hyperparameter combination to complete the side channel attack.

Claims

1. A side channel attack method based on multi-label and multi-expert networks, characterized in that: The steps include: (1) Obtain energy trace data; To obtain energy trace data, we directly use the original energy trace dataset published by the target cryptographic algorithm and divide it into training and test sets. (2) Design and construct a three-dimensional multi-label matrix; First, a multi-label characterization of a single key byte of the target cryptographic algorithm is constructed based on the binary label calculation method; then a two-dimensional multi-label matrix is constructed for each energy trace; Finally, the multi-label combinations of all key bytes on all energy traces form a three-dimensional multi-label matrix; (3) Design and build a multi-expert network model based on attention mechanism; The multi-expert network model based on the attention mechanism includes an input layer, an expert network layer, a shared layer, and an output layer; the input layer receives input data; The expert network layer consists of multiple expert networks. Each expert network uses the attention mechanism to learn and extract the characteristics of a key byte of the target cryptographic algorithm on the energy trace. The shared layer fuses the features output by all expert networks. The output layer realizes the parallel prediction of all key bytes of the target cryptographic algorithm. (4) Multi-expert network model training based on attention mechanism; Input the energy trace matrix of the training set and the corresponding multi-label matrix into the constructed model, find the best hyperparameter combination through grid search, complete the model training, and save it; (5) Implement side channel attacks based on the trained multi-expert network model; The trained multi-expert network model is tested on the test set. By analyzing the results of the model's parallel output, all key bytes of the target cryptographic algorithm are recovered to complete the side channel attack.

2. According to the side channel attack method based on multi-label and multi-expert network in claim 1, it is characterized in that: Step (1) is to obtain energy trace data, and the specific steps are as follows: (1.1) Assume that the key of the target cryptographic algorithm contains K key bytes, and assume that there are N energy traces in the public raw energy trace data set of the target cryptographic algorithm, represented by T = {t1, t2, …, t i ,…,t N }, where t i represents the i-th energy trace, 1≤i≤N; (1.2) The energy trace dataset T is divided into a training set containing n energy traces and a test set containing m energy traces, where n+m=N.

3. The side channel attack method based on multi-label and multi-expert network according to claim 1, characterized in that: Step (2) is to design and construct a three-dimensional multi-label matrix. The specific steps are as follows: (2.1) Calculate the multi-label of a single key byte based on the binary label calculation method. Assume that the decimal median value of the jth key byte corresponding to the i-th energy trace in the training set is L i,j , L i,j =f(p i,j ,k i,j ), where p i,j and k i,j denotes the j-th byte value of the plaintext and key corresponding to the i-th energy trace, 1≤i≤n, 1≤j≤K; f(·) is an intermediate value calculation function; L i,j Converted to 8-bit binary label Y i,j ={Y i,j [b]|b=1,2,...,8},Y i,j [b] indicates label Y i,j The b-th sub-label in is calculated as follows, where Indicates rounding down: (2.2) According to the multi-label construction method in step (2.1), construct the binary labels of all key bytes of the i-th energy trace and splice them into a two-dimensional multi-label combination (Y i,1 ,Y i,2 ,…,Y i,j ,…,Y i,K ); (2.3) Based on the two-dimensional multi-label combination of all key bytes of an energy trace constructed in step (2.2), the label combinations of all key bytes corresponding to each of the n energy traces are concatenated to form a three-dimensional multi-label matrix H, as shown below:

4. The side channel attack method based on multi-label and multi-expert network according to claim 1, characterized in that: Step (3) is to design and build a multi-expert network model based on the attention mechanism. The specific steps are as follows: (3.1) The multi-expert network model based on the attention mechanism includes an input layer, an expert network layer, a shared layer, and an output layer; (3.2) Data preprocessing; (3.2.1) In order to reduce the dimension of the data and eliminate the difference in the value range, all n original energy traces in the training set are resampled and reduced to reduce the number of time sample points in the energy trace to R. Then, each energy trace is normalized to the minimum and maximum values. The value t of the rth time sample point in the i-th energy trace is i [r] The minimum and maximum normalization processing method is as follows: 1≤i≤n, 1≤r≤R, and the value of the sample point after processing is t i '[r]: Where min(·) and max(·) represent the minimum and maximum values of the sample points in the i-th energy trace, respectively; (3.2.2) Copy all processed energy traces K times and concatenate them into an energy trace matrix T' of shape n × K; (3.3) Input the multi-label matrix H and the energy trace matrix T' into the model, and complete the input of the above data through the input layer; (3.4) Design and build the expert network layer; (3.4.1) To learn and extract the K key bytes corresponding to the energy trace of the target cryptographic algorithm in parallel, K expert networks with identical structures and executed in parallel are constructed. Each expert network consists of a local connection layer, an LSTM layer, and an attention mechanism module. Each expert network learns and extracts features for the key bytes corresponding to the expert network based on the input energy trace matrix T' and the multi-label matrix H. (3.4.2) The convolution kernel size of the local connection layer is 52, the number of filters is 1, and the stride is 13. It reduces the complexity of subsequent data processing by compressing the data dimension while retaining important features; (3.4.3) The LSTM layer contains 128 neurons. The LSTM layer can selectively retain or discard features by controlling the forget gate and input gate, thereby capturing the dependencies between features compressed by the local fully connected layer at different time steps. (3.4.4) To ensure that the model can extract valuable feature information and reduce the impact of noise, an attention mechanism module is added after the LSTM layer. This module consists of a fully connected layer with 1 neuron, a batch normalization layer, and a softmax layer. The fully connected layer generates a scalar score for each time step to help determine the importance of each time step. The batch normalization layer further normalizes the score, and finally the softmax layer outputs the final score for each time step. The final score is then weighted with the features output by the LSTM layer to selectively focus on the corresponding features. (3.5) The shared layer consists of the Inception module, the Dropout layer, and the convolution block to achieve feature fusion; (3.5.1) The Inception module consists of three one-dimensional convolutional layers in parallel. The convolution kernel size of each of the three convolutional layers is 4, and the number of filters is 1, 7, and 11 respectively. By splicing these three convolutional layers, feature extraction is further completed, thereby obtaining a richer feature representation. (3.5.2) In the Dropout layer, the probability of random neuron inactivation is set to 20%. During each forward propagation, some neurons are randomly shut down so that they do not participate in the calculation. This prevents the model from being overly dependent on the training data, thereby effectively improving the generalization ability and robustness of the model. (3.5.3) The convolution block consists of a convolutional layer, a normalization layer, and an average pooling layer, which is used to extract local features. The convolutional layer has a kernel size of 4 and a filter number of 1. The normalization layer is used to standardize the output of the convolutional layer to enhance the stability of the model. The window size and stride of the average pooling layer are both set to 2 to reduce the feature dimensionality and retain key information. (3.6) The output layer has K output branches with the same structure. Each branch consists of one flattening layer and three fully connected layers. (3.6.1) The flattening layer converts the multidimensional feature tensor processed by the shared layer into a one-dimensional vector to facilitate further processing by the subsequent fully connected layer. (3.6.2) Among the three fully connected layers, the first two fully connected layers contain 10 neurons each, and the SeLu activation function is used to alleviate the gradient explosion and gradient vanishing problems in the neural network. To meet the requirements of multi-label classification, the last fully connected layer is configured with 8 neurons, and the Sigmoid activation function is used to complete the output of the probability that each sub-label of the corresponding key byte is 1.

5. The side channel attack method based on multi-label and multi-expert network according to claim 1, characterized in that: Step (4) is the training of a multi-expert network model based on the attention mechanism. The specific steps are as follows: (4.1) Input the energy trace matrix T' constructed in step (3.2) and the three-dimensional multi-label matrix H constructed in step (2) into the constructed multi-expert network model in a cyclic manner; (4.2) Grid search was performed on different optimizers, learning rates, batch sizes, and epochs. Candidate optimizers included Adam, Adamax, RMSprop, Adadelta, and SGD; candidate learning rates were 0.01, 0.05, 0.001, 0.005, 0.0001, and 0.0005; candidate batch sizes were 32, 64, 128, and 256; and candidate epochs were 50, 100, 150, 200, 250, and 300. The above candidates were combined to form 720 hyperparameter combinations to form a grid search space. (4.3) Traverse the above grid search space, train the model with different hyperparameter combinations, and save the corresponding trained model.

6. The side channel attack method based on multi-label and multi-expert network according to claim 1, characterized in that: Step (5) is to implement a side channel attack based on the trained multi-expert network model. The specific steps are as follows: (5.1) For the test set containing m energy traces, resample and reduce the dimension according to the method in step (3.2.1), and perform minimum and maximum value normalization processing respectively to obtain the preprocessed energy trace data; (5.2) Copy all processed energy traces K times and concatenate them into an energy trace matrix T' with a shape of m × K; (5.3) Input the energy trace matrix T″ into the multi-expert network model trained in step (4) in sequence; (5.4) In each multi-expert network model, calculate the best candidate key for all key bytes of the target cryptographic algorithm; (5.4.1) For the sth test energy trace t after preprocessing s ”, 1≤s≤m, on the jth key byte, let the candidate key k * is the random variable K * The value of k * ∈[0,255], 1≤j≤K; Based on the output of the model, the candidate key k is calculated * The predicted probability is P j (K * =k * |t s ”); (5.4.2) Using the cumulative method, calculate the sum of the probabilities of the j-th key byte corresponding to k* on all test energy traces, and obtain the best candidate key for the j-th key byte through maximum likelihood estimation The calculation method is: (5.4.3) Calculate the best candidate key for each of the K key bytes of the target cryptographic algorithm using the methods in steps (5.4.1) and (5.4.2); (5.5) Repeat step (5.4) on all saved models and calculate the best candidate key corresponding to each model; (5.6) The minimum number of energy traces required for each model to calculate the best candidate key is used as the evaluation metric. The results of all models obtained in step (5.5) on the test set are compared to determine the optimal model. The hyperparameter combination corresponding to the model is used as the optimal hyperparameter combination to complete the side channel attack.

Images