A timing analysis detection system and method for a trusted cryptographic module (TCM)

Abstract

The application relates to the technical field of trusted computing, and discloses a timing analysis detection system and method for a trusted cryptographic module (TCM), which comprises a TCM, a test platform and a signal acquisition device. The TCM executes a cryptographic operation test command sent by the test platform, and triggers the signal acquisition device to sample through the control of the IO pin level state connected therewith; the signal acquisition device records the time difference of the IO pin level pull-up / pull-down as a single operation time. The test platform changes input parameter groups to perform multiple rounds of tests, and calculates the average operation time of each parameter group. By comparing the average operation time of the same command under different parameter groups, if the absolute difference is less than the single clock cycle value epsilon of the TCM, the TCM is determined to pass the timing attack security test. The application realizes automatic acquisition and analysis of test data, reduces the operation complexity, and improves the test efficiency and practicability.

Description

Technical Field

[0001] This invention relates to the field of trusted computing technology, specifically a timing analysis and detection system and method for a trusted cryptographic module (TCM). Background Technology

[0002] The abbreviations and key terms used in this specification are defined as follows:

[0003] Trusted Cryptography Module (TCM): A hardware module of the trusted computing platform that provides cryptographic operation functions for the trusted computing platform and has protected storage space.

[0004] To ensure the security of TCM trusted cryptographic modules, non-intrusion attack testing is typically required, including energy analysis attacks, electromagnetic analysis attacks, and timing analysis attacks. However, existing non-intrusion attack testing methods are often complex to operate and difficult to implement, making them less than ideal in terms of practicality and convenience for most enterprise users. To address this issue and enable enterprises to more conveniently and efficiently conduct non-intrusion attack testing, especially timing analysis attack testing, on TCM trusted cryptographic modules, it is therefore crucial to develop a timing analysis detection system and method for TCM trusted cryptographic modules. Summary of the Invention

[0005] The purpose of this invention is to overcome the above-mentioned technical problems and provide a timing analysis and detection system for Trusted Cryptographic Modules (TCMs).

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0007] A timing analysis and testing system for a trusted cryptographic module (TCM) includes a TCM, a test platform, and a signal acquisition device.

[0008] The Trusted Cryptography Module (TCM) is used to execute cryptographic operation test commands sent by the test platform and control the level value of its I / O pins connected to the signal acquisition device; the signal acquisition device triggers its sampling operation based on the level value and records the time when the I / O pins are pulled high or low.

[0009] The test platform acquires and records the waveform of the level value switching and the time of pulling up and down the IO pins from the signal acquisition device, and obtains the time of a single level value switching waveform cycle as the calculation time of a single execution of the cryptographic operation test command; and sends the cryptographic operation test command to the trusted cryptographic module TCM by changing the input parameter group to perform N tests, and obtains the average calculation time of executing the cryptographic operation test command N times under the same parameter group, and compares the average calculation time of executing the same cryptographic operation test command under different parameter groups. When the absolute difference of the average calculation time is less than the single clock cycle value ε of the trusted cryptographic module TCM, the trusted cryptographic module TCM is determined to have passed the timed attack security test.

[0010] Furthermore, the changed input parameter group includes two parameter groups: the first is to input the same key and different plaintext; the second is to input different keys and the same plaintext.

[0011] Furthermore, the control of the I / O pin connected to the signal acquisition device, and the signal acquisition device triggering its sampling operation based on the controlled I / O pin level, specifically involves:

[0012] If the initial level of the IO pin is high, the signal acquisition device is set to fall-edge triggered. The trusted cryptographic module (TCM) first pulls the level of the IO pin low, and the signal acquisition device starts capturing waveforms. After the trusted cryptographic module (TCM) executes the cryptographic operation test command, it pulls the level of the IO pin high again, and the signal acquisition device ends the single sampling.

[0013] If the initial level of the IO pin is low, the signal acquisition device is set to rise-edge triggered. The trusted cryptographic module (TCM) first pulls the level of the IO pin high, and the signal acquisition device starts capturing waveforms. After the trusted cryptographic module (TCM) executes the cryptographic operation test command, it pulls the level of the IO pin low, and the signal acquisition device ends the single sampling.

[0014] Furthermore, the signal acquisition device is an oscilloscope.

[0015] Furthermore, the cryptographic operation test commands include at least one of the following: SM2 signing, verification, encryption, and decryption; SM3 HMAC calculation; and SM4 encryption and decryption.

[0016] This invention also provides a timing analysis and detection method for a Trusted Cryptographic Module (TCM), comprising the following steps:

[0017] S1: Send a cryptographic operation test command to the Trusted Cryptographic Module (TCM) through the test platform;

[0018] S2: The trusted cryptographic module TCM executes the cryptographic operation test command and controls the level state of its IO pins connected to the signal acquisition device;

[0019] S3: The signal acquisition device is triggered to perform sampling based on the change in the level of the IO pin, and records the time when the IO pin level is pulled high or low;

[0020] S3: The test platform obtains the sampling waveform of the single clock cycle level value switching from the signal acquisition device, obtains the operation time of executing a single cryptographic operation test command, and changes the input parameter group to perform N tests, obtains the average operation time of executing N cryptographic operation test commands with the same parameter group, and compares the average operation time of executing the same cryptographic operation test command under different parameter groups. When the absolute difference of the average operation time is less than the single clock cycle value ε of the Trusted Cryptographic Module TCM, it is determined that the Trusted Cryptographic Module TCM passes the timed attack security test.

[0021] Furthermore, in step S2, the level state of the IO pins connected to the signal acquisition device is controlled. The signal acquisition device triggers sampling based on the change in the IO pin level. Specifically:

[0022] If the initial level of the IO pin is high, the signal acquisition device is set to fall-edge triggered. The trusted cryptographic module (TCM) first pulls the level of the IO pin low, and the signal acquisition device starts capturing waveforms. After the trusted cryptographic module (TCM) executes the cryptographic operation test command, it pulls the level of the IO pin high again, and the signal acquisition device ends the single sampling.

[0023] If the initial level of the IO pin is low, the signal acquisition device is set to rise-edge triggered. The trusted cryptographic module (TCM) first pulls the level of the IO pin high, and the signal acquisition device starts capturing waveforms. After the trusted cryptographic module (TCM) executes the cryptographic operation test command, it pulls the level of the IO pin low, and the signal acquisition device ends the single sampling.

[0024] Furthermore, the signal acquisition device is an oscilloscope.

[0025] Furthermore, the cryptographic operation test commands include at least one of the following: SM2 signing, verification, encryption, and decryption; SM3 HMAC calculation; and SM4 encryption and decryption.

[0026] Furthermore, N times in step S3 is 10 times or more.

[0027] This invention integrates a testing platform and a signal acquisition device to perform timing analysis attack testing on a Trusted Cryptographic Module (TCM). It achieves automatic data acquisition and analysis, as well as automatic judgment of test results, reducing the complexity and operational difficulty of testing, improving the convenience of testing, and enhancing the practicality of testing. It provides enterprise users with a more convenient and efficient solution for timing analysis attack testing of TCM trusted cryptographic modules. Attached Figure Description

[0028] Figure 1 : A schematic diagram of the workflow of Embodiment 1 of the present invention.

[0029] Figure 2 : A schematic diagram of the workflow of Embodiment 2 of the present invention. Detailed Implementation

[0030] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. To more intuitively and clearly describe the technical solution of the present invention, in the following embodiments, the encryption / decryption chip integrated in the Trusted Cryptography Module (TCM) is a domestically produced chip. The single clock cycle value ε of the Trusted Cryptography Module (TCM) is a fixed value, which is calculated based on the clock frequency of the domestically produced chip. The clock frequency of the domestically produced chip is 60MHz. The fixed value of the single clock cycle value ε = 1 / clock frequency. Therefore, in this embodiment, the fixed value of the single clock cycle value ε is 1 / 60MHz, which is approximately equal to 0.016667μs. Example 1

[0031] This embodiment tests the computation time of the same cryptographic algorithm by inputting the same key with different plaintexts, as detailed below:

[0032] A timing analysis and testing system for a Trusted Cryptographic Module (TCM) includes a TCM, a test platform, and an oscilloscope. Its general working principle is as follows:

[0033] The Trusted Cryptography Module (TCM) executes cryptographic operation test commands sent by the test platform and controls the I / O pin levels connected to the oscilloscope. The oscilloscope triggers sampling based on level changes, and the test platform acquires and records the level switching waveforms from the oscilloscope, then calculates the cryptographic operation time. Through multiple rounds of testing, the average operation time is obtained, and the average operation time under different parameter groups is compared to determine whether the TCM passes the timed attack security test.

[0034] Its working method is described in detail below, such as Figure 1 As shown, it includes the following steps:

[0035] S1: The test platform sends a test command with SM2 signature to the trusted cryptographic module TCM. The parameters of this test command are the same key and different plaintext, such as inputting key 1 and plaintext A.

[0036] S2: After receiving the test command, the Trusted Cryptography Module (TCM) first pulls the I / O pin of the TCM low (this I / O pin is connected to the oscilloscope, and its initial level is high). After performing the SM2 signature operation, it pulls the I / O pin high again. If the initial level is high, the oscilloscope is set to fall-edge triggering. When the I / O pin is pulled low, the oscilloscope will capture the waveform. When the level is pulled high, the current sampling of the oscilloscope ends, and the oscilloscope records the time when the I / O pin level is pulled high and low.

[0037] S3: The test platform acquires the current oscilloscope sampling waveform and the high and low pull-up time of the IO pin level, and uses the high and low pull-up time period of the IO pin level as the calculation time for a single SM2 signature execution;

[0038] S4: Repeat steps S1-S3, perform SM2 signature operations a total of 2000 times, collect the operation time of 2000 SM2 signature tests, and calculate the average operation time t1 of a single cryptographic operation on plaintext A;

[0039] S5: Replace the plaintext A input in step S1 with plaintext B, keep the key the same, and still input key 1. Repeat steps S1-S3 in this way, perform SM2 signature operation 2000 times in total, collect the operation time of 2000 SM2 signature tests, and calculate the average operation time t2 of a single cryptographic operation of plaintext B.

[0040] S6: Set the single clock cycle value ε of the Trusted Cryptographic Module (TCM) as the fault tolerance value. When |t1-t2| < ε, the test passes; otherwise, the test fails. Example 2

[0041] The main difference from Embodiment 1 above is that this embodiment uses different keys and the same plaintext to test the computation time of the same cryptographic algorithm, such as... Figure 2 As shown, the specific steps are as follows:

[0042] S1: The test platform sends an SM4-encrypted test command to the Trusted Cryptographic Module (TCM). The parameters of this test command are different keys and the same plaintext, such as inputting key 2 and plaintext C.

[0043] S2: After receiving the test command, the Trusted Cryptography Module (TCM) first pulls the I / O pin of the TCM high (this I / O pin is connected to the oscilloscope, and its initial level is low). After performing the SM4 encryption operation, it pulls the I / O pin high again. If the initial level is low, the oscilloscope is set to rise-edge triggering. When the I / O pin level is pulled high, the oscilloscope will capture the waveform. When the level is pulled low, the current sampling of the oscilloscope ends.

[0044] S3: The test platform acquires the current oscilloscope sampling waveform and the high and low pull-up times of the IO pins, and uses the high and low pull-up time period of the IO pins as the calculation time for a single SM4 encryption test.

[0045] S4: Repeat steps S1-S3, perform SM4 encryption operations 1000 times in total, collect the operation time of 1000 SM4 encryption tests, and calculate the average operation time t3 of a single cryptographic operation on plaintext C.

[0046] S5: Replace the key 2 input in step S1 with key 3, keep the plaintext unchanged, and keep plaintext C. Repeat steps S1-S3 in this way, perform SM4 encryption operation 1000 times in total, collect the operation time of 1000 SM4 encryption tests, and calculate the average operation time t4 of a single cryptographic operation of plaintext C.

[0047] S6: Set the single clock cycle value ε of the Trusted Cryptographic Module (TCM) as the fault tolerance value. When |t4-t3|<ε, the test passes; otherwise, the test fails.

[0048] In the above embodiments, the test commands are only exemplified by SM2 signing and SM4 encryption. In practical applications, tests can be performed according to the user's needs. This invention includes tests such as SM2 signing, verification, encryption, and decryption, SM3 HMAC calculation, SM4 encryption, and decryption.

[0049] In the above embodiments, the SM4 encryption test was repeated 1000 times, and the SM2 signature was repeated 2000 times. The specific number of times it was executed depended on actual needs. In order to ensure the accuracy of the data and collect as much data as possible, it was best to ensure that the test was repeated more than 10 times.

[0050] The above embodiments deeply integrate and collaborate the test platform, signal acquisition device, and Trusted Cryptographic Module (TCM), realizing automatic data acquisition and analysis, as well as automatic judgment of test results. This reduces the complexity and operational difficulty of testing, improves the convenience of testing, and enhances the practicality of testing, providing enterprise users with a more convenient and efficient TCM trusted cryptographic module timing analysis attack testing solution.

[0051] Finally, it should be noted that the above embodiments are only used to illustrate the present invention and are not intended to limit the technical solutions described in the present invention. Therefore, although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the present invention. All technical solutions and improvements that do not depart from the spirit and scope of the present invention should be covered within the scope of the claims of the present invention.

Claims

1. A timing analysis and detection system for a Trusted Cryptographic Module (TCM), characterized in that: The trusted cryptographic module TCM, a test platform and a signal acquisition device are included. The trusted cryptographic module TCM is used to execute a cryptographic operation test command sent by the test platform and control the level value of an IO pin connected with the signal acquisition device; the signal acquisition device triggers its sampling work according to the level value and records the time when the IO pin is pulled high or low. The test platform obtains and records the waveform of the level value switching and the time when the IO pin is pulled high or low from the signal acquisition device, obtains the time of a single level value switching waveform cycle as the operation time of a single execution of the cryptographic operation test command, sends the cryptographic operation test command to the trusted cryptographic module TCM by changing the input parameter set for N times of testing, obtains the average operation time of N times of execution of the cryptographic operation test command for each same parameter set, and compares the average operation time of the same cryptographic operation test command under different parameter sets, and when the absolute difference of the average operation time is less than the single clock cycle value ε of the trusted cryptographic module TCM, it is determined that the trusted cryptographic module TCM passes the timing attack security test.

2. The timing analysis detection system of a trusted cryptographic module (TCM) according to claim 1, characterized in that The changed input parameter set includes two kinds of parameter sets, the first kind is to input the same key and different plaintexts, and the second kind is to input different keys and the same plaintext.

3. The timing analysis detection system of trusted cryptographic module (TCM) according to claim 1, wherein: The control of the level value of the IO pin connected with the signal acquisition device and the triggering of the sampling work of the signal acquisition device according to the level value are as follows: If the initial level value of the IO pin is high, the signal acquisition device is set to falling edge triggering, the trusted cryptographic module TCM first pulls the level of the IO pin low to become low, and the signal acquisition device starts to capture the waveform; after the trusted cryptographic module TCM executes the cryptographic operation test command, the level of the IO pin is pulled high to become high, and the signal acquisition device ends single sampling; If the initial level of the IO pin is low, the signal acquisition device is set to rising edge triggering, the trusted cryptographic module TCM first pulls the level of the IO pin high to become high, and the signal acquisition device starts to capture the waveform; after the trusted cryptographic module TCM executes the cryptographic operation test command, the level of the IO pin is pulled low to become low, and the signal acquisition device ends single sampling.

4. The timing analysis detection system of trusted cryptographic module (TCM) of claim 1, wherein: The signal acquisition device is an oscilloscope.

5. The timing analysis detection system of trusted cryptographic module (TCM) according to claim 1, wherein: The cryptographic operation test command includes at least one of the signature, signature verification, encryption and decryption of SM2, the HMAC calculation of SM3, and the encryption and decryption of SM4.

6. A timing analysis detection method of a trusted cryptographic module (TCM), the method comprising: The timing analysis detection system of the trusted cryptographic module TCM according to any one of claims 1-2, the steps are as follows: S1: sending a cryptographic operation test command to the trusted cryptographic module TCM through the test platform; S2: the trusted cryptographic module TCM executes the cryptographic operation test command and controls the level state of the IO pin connected with the signal acquisition device; S3: the signal acquisition device triggers its sampling work according to the change of the level of the IO pin and records the time when the level of the IO pin is pulled high or low; S3: The test platform obtains a single clock cycle level value switching sampling waveform from the signal acquisition device, obtains an operation time of executing a single password operation test command, changes an input parameter group to perform N times of testing, obtains an average operation time of executing the password operation test command N times under the same parameter group, and compares the average operation times of executing the same password operation test command under different parameter groups. When the absolute difference of the average operation times is less than a single clock cycle value ε of the trusted cryptographic module TCM, it is determined that the trusted cryptographic module TCM passes the timing attack security test.

7. The method of timing analysis detection of a trusted cryptographic module (TCM) according to claim 6, characterized in that: The step S2 controls the IO pin level state connected with the signal acquisition device. The signal acquisition device triggers the sampling work according to the change of the IO pin level. Specifically: If the initial level value of the IO pin is high, the signal acquisition device is set as falling edge trigger. The trusted cryptographic module TCM first pulls the level of the IO pin to low, and the signal acquisition device starts to capture the waveform. After the trusted cryptographic module TCM executes the password operation test command, the level of the IO pin is pulled to high, and the signal acquisition device ends the single sampling. If the initial level of the IO pin is low, the signal acquisition device is set as rising edge trigger. The trusted cryptographic module TCM first pulls the level of the IO pin to high, and the signal acquisition device starts to capture the waveform. After the trusted cryptographic module TCM executes the password operation test command, the level of the IO pin is pulled to low, and the signal acquisition device ends the single sampling.

8. The timing analysis detection method of a trusted cryptographic module (TCM) according to claim 6, characterized in that: The signal acquisition device is an oscilloscope.

9. The timing analysis detection method of a trusted cryptographic module (TCM) according to claim 6, characterized in that: The password operation test command includes at least one of signature, signature verification, encryption, decryption of SM2, HMAC calculation of SM3, and encryption and decryption of SM4.

10. The timing analysis detection method of a trusted cryptographic module (TCM) according to claim 6, characterized in that: The N times in the step S3 are more than 10 times.

Images