Unmanned aerial vehicle chip sensitive data access control method based on trusted execution environment

Abstract

The invention discloses an unmanned aerial vehicle chip sensitive data access control method based on a trusted execution environment, and relates to the technical field of unmanned aerial vehicle security. If data encryption is carried out, real-time confusion processing is carried out on power consumption, electromagnetic signals and execution time of the unmanned aerial vehicle chip; the trusted execution environment isolates a processing space of sensitive data from a logic level to prevent unauthorized access; the real-time confusion processing performs dynamic interference aiming at the core physical characteristics of the side channel attack, so that an attacker cannot derive an encryption key or algorithm logic through a physical signal of a monitoring chip; according to the method, the chip presents highly unpredictable physical characteristics in the encryption process through the synergistic effect of the power consumption, the electromagnetic signal and the execution time, the side channel attack difficulty is remarkably improved, and multi-level guarantee is provided for safe processing of sensitive data of the unmanned aerial vehicle.

Description

Technical Field

[0001] The present invention belongs to the field of drone security technology, and specifically is a method for controlling access to sensitive data on drone chips based on a trusted execution environment. Background Art

[0002] With the increasing use of drones in military and civilian applications, the sensitive data stored in their chips (such as flight control instructions, communication keys, and mission payload information) faces severe security threats. Existing technologies use trusted execution environments (TEEs) to logically isolate sensitive operations within a secure world, effectively preventing unauthorized access and malicious code injection at the software level. However, TEEs only address logical security issues at the software level and cannot protect against side-channel attacks that exploit physical layer features.

[0003] The core of side-channel attacks lies in exploiting the correlation between encryption operations and physical characteristics: in terms of power consumption, the difference in current consumption between different logic operations on the chip forms a specific waveform, allowing attackers to extract key-related information by analyzing the power consumption traces of the power pins; in terms of electromagnetic characteristics, signal transitions within the chip generate electromagnetic radiation, the frequency and intensity of which are directly related to the type of operation, allowing attackers to restore the encryption process with the help of near-field probes or spectrum analyzers; in terms of time characteristics, the execution time of instructions corresponding to different encryption algorithms or key lengths follows a certain pattern, allowing attackers to infer the algorithm type or key length by measuring the response delay. Existing drone chip protection solutions lack effective countermeasures to these physical layer attacks, resulting in a high risk of sensitive data leakage during the encryption process.

[0004] This application provides a method for controlling access to sensitive data on drone chips based on a trusted execution environment to solve the above technical problems. Summary of the Invention

[0005] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, the present invention proposes a method for controlling access to sensitive data of drone chips based on a trusted execution environment. After configuring a trusted execution environment for the drone, the method detects whether the drone chip performs data encryption. If data encryption is performed, the power consumption, electromagnetic signals and execution time of the drone chip are subjected to real-time obfuscation processing. The trusted execution environment isolates the processing space of sensitive data from a logical level to prevent unauthorized access. The real-time obfuscation processing dynamically interferes with the core physical characteristics of side-channel attacks, making it impossible for attackers to deduce encryption keys or algorithm logic by monitoring the physical signals of the chip. The present invention uses the synergistic effect of power consumption, electromagnetic signals and execution time to make the chip present highly unpredictable physical characteristics during the encryption process, significantly increasing the difficulty of side-channel attacks and providing multi-level protection for the secure processing of sensitive data of drones.

[0006] To achieve the above objectives, the first aspect of the present invention provides a method for controlling access to sensitive data on a drone chip based on a trusted execution environment, comprising: Configure a trusted execution environment for the drone; Detect whether the drone chip performs data encryption; if so, initiate real-time obfuscation processing of the side channel characteristic parameters of the encryption process; the real-time obfuscation processing includes power consumption, electromagnetic signals and execution time.

[0007] Preferably, performing real-time obfuscation processing on the side channel characteristic parameters includes: When an obfuscated instruction is detected, the side channel characteristic parameters of the drone chip are detected in real time; the side channel characteristic parameters include power consumption waveform, electromagnetic signal and execution time; Perform random simulated obfuscation on the side channel characteristic parameters.

[0008] Preferably, performing random simulation obfuscation on the power consumption waveform includes: Mark the power consumption waveform as basic power consumption; Generate random power consumption, dynamically superimpose the random power consumption with the basic power consumption, and complete the random simulation confusion of power consumption.

[0009] Preferably, performing random simulation obfuscation on the electromagnetic signal includes: Shielding electromagnetic signals; Generate an electromagnetic confusion signal, radiate the electromagnetic confusion signal into space, and complete the random simulation confusion of the electromagnetic signal.

[0010] Preferably, random simulation obfuscation is performed on the execution time, including: Dynamically change the main clock frequency; generating a random phase offset sequence, and performing phase modulation on a clock signal based on the random phase offset sequence; Start irrelevant tasks, change the time consumption distribution, and achieve random simulation confusion of execution time.

[0011] Preferably, performing real-time obfuscation processing on the side channel characteristic parameters includes: When an obfuscated instruction is detected, the side channel characteristic parameters of the drone chip are detected in real time; the side channel characteristic parameters include power consumption waveform, electromagnetic signal and execution time; Perform directional analog obfuscation on side channel characteristic parameters.

[0012] Preferably, before performing directional simulation obfuscation, a target algorithm is selected, including: Determine the basic algorithm corresponding to data encryption; The encryption algorithms whose execution time is longer than that of the basic algorithms are integrated into an algorithm set; An encryption algorithm with similar power consumption waveform and electromagnetic signal to the basic algorithm is selected from the algorithm set as the target algorithm.

[0013] Preferably, an encryption algorithm having a power consumption waveform and an electromagnetic signal similar to those of the basic algorithm is selected from the algorithm set as the target algorithm, including: Extract the average memory usage of each encryption algorithm in the algorithm set during power consumption simulation and electromagnetic simulation; The reciprocal of the average memory usage is normalized and used as the weight coefficient for power consumption simulation and electromagnetic simulation; Calculate the similarity of power consumption waveforms and electromagnetic signals between each encryption algorithm and the basic algorithm in the algorithm set; perform weighted calculation on the similarity and weight to obtain a comprehensive score, and select the encryption algorithm with the largest comprehensive score as the target algorithm.

[0014] Preferably, performing directional simulation obfuscation on the side channel characteristic parameters includes: Real-time monitoring of the actual power consumption in the drone chip power circuit, extracting the target power consumption of the target algorithm when processing data; power consumption simulation based on the target power consumption and actual power consumption, achieving directional power consumption obfuscation of the power consumption waveform; Shield electromagnetic signals; generate electromagnetic confusion signals according to the electromagnetic signals of the target algorithm, radiate the electromagnetic confusion signals into space, and complete the directional simulation confusion of electromagnetic signals; Dynamically change the main clock frequency according to the instruction cycle time data of the target algorithm; generate a random phase offset sequence, and phase modulate the clock signal based on the random phase offset sequence; start irrelevant tasks, change the time consumption distribution, and achieve directional simulation obfuscation of execution time.

[0015] Preferably, during external simulation, power consumption simulation is performed based on target power consumption and actual power consumption, including: Extract actual power consumption and target power consumption; The power consumption difference between the target power consumption and the actual power consumption is used as the power consumption simulation quantity; the power consumption simulation quantity is simulated and generated to achieve directional simulation confusion of the power consumption waveform.

[0016] Preferably, during the internal simulation, power consumption simulation is performed based on the target power consumption and the actual power consumption, including: Extract the actual power consumption and target power consumption, and monitor the power consumption consumed by the targeted hybrid simulation in real time, marking it as additional power consumption. The power consumption difference between the target power consumption and the actual power consumption and the extra power consumption is taken as the power consumption simulation quantity; the power consumption simulation quantity is generated by simulation to realize the directional simulation confusion of the power consumption waveform.

[0017] Compared with the prior art, the present invention has the following beneficial effects: 1. After configuring a trusted execution environment (TEE) for a drone, the present invention detects whether the drone chip is performing data encryption. If data encryption is performed, the chip's power consumption, electromagnetic signals, and execution time are obfuscated in real time. The TEE logically isolates the processing space for sensitive data to prevent unauthorized access. The real-time obfuscation process dynamically interferes with the core physical characteristics of side-channel attacks, preventing attackers from deriving encryption keys or algorithm logic by monitoring the chip's physical signals. Through the synergistic effects of power consumption, electromagnetic signals, and execution time, the present invention makes the chip exhibit highly unpredictable physical characteristics during the encryption process, significantly increasing the difficulty of side-channel attacks and providing multi-level protection for the secure processing of sensitive drone data.

[0018] 2. The real-time obfuscation processing of the present invention can be random simulated obfuscation, in which the randomly generated power consumption fluctuations are dynamically superimposed on the real power consumption, so that attackers cannot monitor the characteristic power consumption pattern of the encryption operation through the power pin; the electromagnetic obfuscation signal covers the real electromagnetic radiation with broadband random noise, and combines with the active shielding array to offset the leakage signal, which can eliminate the characteristic spectrum lines of the encryption operation in a specific frequency band and resist near-field electromagnetic scanning attacks; dynamically change the main clock frequency and generate a random phase offset sequence, and cooperate with the parallel scheduling of unrelated tasks to make the execution timing of the encryption instructions show irregular changes, breaking the correlation between the time characteristics and the key operation, and preventing attackers from using the execution time difference to infer the key; under the synergistic effect of the three in the present invention, it significantly increases the difficulty for attackers to obtain sensitive information through the side channel, providing drone chips with lightweight and highly generalized security protection capabilities.

[0019] 3. The real-time obfuscation processing of the present invention can be directional analog obfuscation. Through directional analog obfuscation, the power consumption, electromagnetic signal and execution time characteristics of the actual encryption operation of the drone chip can be accurately disguised as the characteristics of the target algorithm, realizing "active misleading" defense; the directional obfuscation mechanism of the present invention can transform side-channel attacks into "algorithm feature misjudgment". The key or algorithm model obtained by the attacker based on the parameter analysis after obfuscation is misleading. Not only can it not crack the actual encryption process, but it will also consume attack resources and deviate from the correct direction. It is particularly suitable for high-security scenarios that need to defend against advanced side-channel attacks, and provides a deep protection capability for the sensitive data processing of drone chips that is both targeted and deceptive. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0021] Figure 1 This is a schematic diagram of the steps of a method for controlling access to sensitive data on a drone chip according to an embodiment of the present invention; Figure 2 Schematic diagram of the steps of a method for random simulation obfuscation of power consumption waveforms according to an embodiment of the present invention; Figure 3 Schematic diagram of the method steps for directional simulation obfuscation of power consumption waveforms in an embodiment of the present invention. DETAILED DESCRIPTION

[0022] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0023] See also Figure 1 The first embodiment of the present invention provides a method for controlling access to sensitive data of a drone chip based on a trusted execution environment, comprising: S100: Configure a trusted execution environment for the drone; S200: Detect whether the drone chip performs data encryption; if yes, start real-time obfuscation processing of the side channel characteristic parameters of the encryption process; the real-time obfuscation processing includes power consumption, electromagnetic signals and execution time.

[0024] Drone chips store a large amount of data, primarily sensitive and non-sensitive data. Sensitive data includes flight control data, communication keys and protocol data, mission payload data, and system configuration data.

[0025] Flight control data is crucial for the proper flight and precise control of drones, directly impacting their ability to operate stably, safely, and according to pre-set requirements. This data primarily includes flight attitude data (roll, pitch, and yaw angles), trajectory data (coordinate information such as longitude, latitude, and altitude), and flight control system parameters (PID control parameters, motor response speed, and propeller speed). Leakage or tampering of this data could lead to loss of control of the drone, or even malicious exploitation, resulting in serious safety incidents.

[0026] Communication keys and protocol data are crucial for ensuring drone communications security and data transmission accuracy, ensuring the confidentiality, integrity, and reliability of communications between drones and ground control stations or other equipment. These data primarily include encryption keys and protocols. If the communication keys are cracked or the protocols are maliciously exploited, communication data such as drone flight instructions and real-time status information could be intercepted, tampered with, or forged, preventing the drone from properly receiving and executing control commands.

[0027] Mission payload data contains critical information about drones performing specific missions. It directly impacts the mission's completion and application value, and provides crucial data support for drones' diverse applications. Mission payload data primarily includes mission instructions, sensor data, and mission execution status. Leakage of mission payload data can lead to mission failure and, in some scenarios, pose serious security and privacy threats.

[0028] System configuration data is fundamental to the proper operation and functionality of drone systems. It determines the drone's hardware and software configuration, function settings, and how it interacts with external devices, playing a key role in the drone's overall performance and user experience. System configuration data primarily includes hardware configuration parameters, software configuration, and system security settings. Tampering with system configuration parameters can cause the drone to malfunction at best, or introduce security vulnerabilities, exposing it to attacks.

[0029] To protect data security in drone chips, a Trusted Execution Environment (TEE) is currently being widely used in drones. This TEE utilizes architectures such as ARM TrustZone and RISC-V Privilege Levels to partition the processor into a secure and non-secure world. The secure world runs a TEE operating system (such as OP-TEE or QTEE) and handles sensitive tasks, while the non-secure world runs a standard operating system (such as Linux or RTOS) for non-sensitive tasks.

[0030] However, even if a drone is configured with a trusted execution environment, it may still be attacked and leak data. This is because the trusted execution environment mainly solves the logical isolation and data confidentiality protection at the software level. During the data processing process, certain characteristic parameters can be used to analyze and crack the encryption algorithm. The cracked encryption algorithm can be used to encrypt the intercepted data, resulting in data leakage.

[0031] In particular, side-channel attacks rely on physical layer information leakage to launch attacks, which is different from the software layer protection of the trusted execution environment. Therefore, it is difficult for the feasible execution environment to prevent side-channel attacks.

[0032] The core of a side-channel attack is to exploit the correlation between physical phenomena during cryptographic operations, such as timing, power consumption, and electromagnetic characteristics, and the key or intermediate calculation results. By measuring and analyzing this physical information, attackers can infer key information and decrypt encrypted data. The following explains the principles of side-channel attacks: 1. Power consumption analysis: When a drone chip performs key operations in a trusted execution environment (TEE), the power consumption trace can be obtained by monitoring the drone chip's power pins. By comparing the fluctuation pattern in the power consumption trace with a known algorithm, the key (or private key) can be derived. Although the key is generated in a trusted execution environment, the power consumption characteristics are related to the operation logic, which the trusted execution environment cannot protect against.

[0033] 2. Electromagnetic signature analysis: When a drone chip performs key operations in a trusted execution environment (TEE), it can use an electromagnetic probe to scan the electromagnetic signals generated by the chip during reading and writing. By comparing the signal frequency with the signal frequency of a known encryption algorithm, it can also derive the key (or private key). However, since the TEE does not provide electromagnetic shielding, it cannot protect against this type of attack.

[0034] 3. Temporal signature analysis: When a drone chip performs key operations in a trusted execution environment (TEE), it can measure the time differences between drone responses to commands and infer the key (or private key) based on the fixed time patterns of encryption operations. The TEE cannot provide effective protection against this.

[0035] S200: Detect whether the drone chip performs data encryption; if so, start real-time obfuscation processing of the side channel characteristic parameters of the encryption process.

[0036] Real-time obfuscation primarily involves simulating the power consumption, electromagnetic signals, and execution time of the drone chip when processing sensitive data. This simulated obfuscation is implemented through an obfuscation control module, which is connected to the drone chip's security monitoring module (such as the Trusted Execution Environment) and is used to receive obfuscation commands. Upon receiving an obfuscation command, the module initiates real-time obfuscation of the side channel characteristic parameters; otherwise, obfuscation is not initiated.

[0037] In a preferred embodiment, performing real-time obfuscation processing on side channel characteristic parameters includes: S110: When an obfuscated instruction is detected, side channel characteristic parameters of the drone chip are detected in real time; wherein the side channel characteristic parameters include power consumption waveform, electromagnetic signal, and execution time; S120: Perform random simulation obfuscation on the side channel characteristic parameters.

[0038] See also Figure 2 In a preferred embodiment, performing random simulation obfuscation on the power consumption waveform includes: S121-1: Mark the power consumption waveform as basic power consumption; S121-2: Generate random power consumption, dynamically superimpose the random power consumption with the basic power consumption, and complete the random simulation confusion of the power consumption.

[0039] The confusion control module includes a power consumption confusion unit, an electromagnetic confusion unit and a time confusion unit.

[0040] The randomized simulated obfuscation of power consumption waveforms is implemented by the power obfuscation unit, which includes a dynamic load regulator and an energy buffer. The dynamic load regulator, consisting of a programmable resistor / capacitor array, simulates power consumption fluctuations by adjusting the load. The energy buffer, consisting of a supercapacitor or superinductor, compensates for sudden energy demands during obfuscation, preventing sudden voltage drops that could affect normal chip operation.

[0041] When the drone chip encrypts sensitive data, the programmable resistor / capacitor array is randomly adjusted through the dynamic load regulator, and random power consumption is introduced after the random adjustment. After the random power consumption is dynamically superimposed with the actual power consumption of the drone chip during encryption, the power consumption after dynamic superposition is obtained by monitoring the power pin current of the drone chip, but the actual power consumption of the drone chip during encryption cannot be obtained, that is, the key cannot be derived through power consumption analysis.

[0042] It is worth noting that during power consumption simulation, the simulation process itself will generate a certain amount of energy consumption. However, since the simulated power consumption results are random, the power consumption detected by the power pin after the simulation does not need to be limited to its power consumption waveform, that is, its power consumption waveform does not need to be similar to that of any other encryption algorithm, so there is no need to consider the power consumption generated during the simulation.

[0043] It should be noted that the dynamic load regulator can be controlled based on the binary sequence output by the random number generator. In the case of a programmable resistor array, the binary sequence corresponds to the on / off state of a particular resistor, such as "1010" indicating the connection of resistors R1 and R3. In the case of a programmable capacitor array, the binary sequence corresponds to the charge / discharge state of the capacitors, such as "011" indicating the connection and charging of capacitors C2 and C3.

[0044] During the random adjustment process of the dynamic load regulator, the energy buffer monitors the power supply voltage in real time. When the dynamic load causes the power supply voltage to drop below a threshold (such as 5%), the supercapacitor (or superinductor) releases energy to provide instantaneous current compensation. When the load power consumption is lower than the average level, the supercapacitor (or superinductor) absorbs excess energy to maintain a stable voltage.

[0045] After the encryption work of the drone chip is completed, the power consumption obfuscation unit enters low-power mode. The dynamic load regulator switches to a fixed load to avoid interfering with the normal operation of the chip; the random number generator suspends output; and the energy buffer enters the charging state to reserve energy for the next obfuscation.

[0046] In a preferred embodiment, performing random simulation obfuscation on the electromagnetic signal includes: S122-1: Shielding electromagnetic signals; S122-2: Generate an electromagnetic confusion signal, radiate the electromagnetic confusion signal into space, and complete random simulated confusion of the electromagnetic signal.

[0047] Randomized simulated obfuscation of electromagnetic signals is achieved by an electromagnetic obfuscation unit, which includes an electromagnetic radiation simulator and an active shielding array. The electromagnetic radiation simulator integrates a multi-channel RF generator to generate electromagnetic signals of specific frequency and intensity. The active shielding array, consisting of an antenna array and a digital signal processor (DSP), transmits an inverted signal to offset the chip's actual electromagnetic radiation.

[0048] When encrypting sensitive data on drone chips, an electromagnetic radiation simulator randomly generates an electromagnetic obfuscation signal and radiates it into space via an antenna array. The active shielding array, based on the reverse phase information of the real electromagnetic signal, generates a cancellation signal with equal amplitude and opposite phase to the real electromagnetic signal, suppressing the propagation of the real electromagnetic signal. This cancellation signal then suppresses the actual electromagnetic signal during electromagnetic monitoring. Therefore, the generated electromagnetic obfuscation signal is the actual electromagnetic signal being monitored, making it impossible to derive the key from the monitored signal.

[0049] In a preferred embodiment, random simulation obfuscation is performed on the execution time, including: S123-1: Dynamically change the main clock frequency; S123-2: Generate a random phase offset sequence, and perform phase modulation on the clock signal based on the random phase offset sequence; S123-3: Start irrelevant tasks, change the time consumption distribution, and achieve random simulation confusion of execution time.

[0050] The time obfuscation unit consists of a time obfuscator, an instruction pipeline disruptor, and a parallel operation scheduler. The time obfuscator contains a programmable clock divider and phase adjuster, which dynamically adjusts the chip's main clock frequency to simulate the instruction cycle times of different algorithms. The instruction pipeline disruptor inserts invalid instructions or repeats some operations in the CPU pipeline, delaying the execution of sensitive instructions. The parallel operation scheduler: Leveraging the chip's multi-core or coprocessor resources, it executes unrelated operations in parallel with sensitive operations, changing the overall time consumption distribution.

[0051] Before performing time obfuscation, the programmable clock divider parameters are configured, primarily including the clock frequency fluctuation range and variation period. The phase adjuster is initialized to set the maximum phase offset range and random offset interval. When encrypting sensitive data on the drone chip, the programmable clock divider dynamically changes the master clock frequency, randomizing it. The phase adjuster generates a random phase offset sequence, phase-modulating the clock signal and randomizing the phase relationship between adjacent clock cycles. Based on the randomized clock, the instruction pipeline disruptor perturbs the encrypted instruction stream, further obscuring the timing characteristics of instruction execution. The parallel operation scheduler simultaneously launches unrelated tasks, altering the overall time consumption distribution at the system level and submerging the timing characteristics of encryption operations within the temporal noise of multiple tasks.

[0052] It should be noted that random phase offset sequences can be either periodic or continuous. Periodic offsets are based on integer multiples of the clock period and are implemented using a programmable clock divider or counter. Each offset is an integer multiple of a fixed period (e.g., ±1 period, ±2 periods, etc.). Its core principle is to introduce discrete, periodically controllable phase jumps at the edges (rising / falling) of the clock signal, with the offset repeating within a certain period. Continuous offsets generate continuous random offsets within the phase space (0-360°), adjusting the phase of the clock signal in real time using a phase modulator (such as a digital phase-locked loop (DLL) or an analog phase shifter). Its core principle is continuous phase variation with no fixed period or step limit, and each offset can take any value within a certain range.

[0053] It's worth noting that during the operation of the time obfuscator, the drone chip's temperature and power supply voltage are continuously monitored. If abnormal voltage fluctuations or temperature exceeds the limit are detected, the default clock configuration is immediately restored to ensure that clock frequency fluctuations do not cause abnormal operation of the drone chip. This monitoring is achieved through a temperature sensor set in the encrypted operation area of ​​the drone chip and a voltage monitoring circuit that can monitor the power supply voltage.

[0054] This embodiment uses an obfuscation control module to obfuscate the actual working performance of the drone chip from the perspectives of power consumption, electromagnetics, and time when the drone chip is performing sensitive data encryption processing, so as to make it difficult to derive the key.

[0055] Example 2: Compared with Example 1, this example uses an obfuscation control module to process the power consumption, electromagnetic and time of the drone chip when processing encrypted data, concealing the real power consumption, electromagnetic signals and time. At the same time, when using power consumption, electromagnetic signals and time to derive the key, it will guide it to derive other false keys.

[0056] In a preferred embodiment, performing real-time obfuscation processing on side channel characteristic parameters includes: S110: When an obfuscated instruction is detected, side channel characteristic parameters of the drone chip are detected in real time; wherein the side channel characteristic parameters include power consumption waveform, electromagnetic signal, and execution time; S120: Performing directional simulation obfuscation on the side channel characteristic parameters.

[0057] The obfuscation control module includes a power consumption obfuscation unit, an electromagnetic obfuscation unit and a time obfuscation unit, as well as a typical algorithm feature unit, which stores the power consumption waveform, electromagnetic signal and execution time of a typical encryption algorithm.

[0058] After the obfuscation control module identifies the encryption algorithm used by the drone chip when performing sensitive data encryption processing, it uses the encryption algorithm as the basic algorithm to extract the power consumption waveform, electromagnetic signal and execution time of the basic algorithm. These data can be obtained through pre-simulation.

[0059] The target algorithm is obtained by matching the typical algorithm feature units based on the power consumption waveform, electromagnetic signal and execution time. The data corresponding to the target algorithm is the object to be simulated by the power consumption confusion unit, electromagnetic confusion unit and time confusion unit.

[0060] In a preferred embodiment, before performing directional simulation obfuscation, selecting a target algorithm includes: S121-1: Determine the basic algorithm corresponding to data encryption; S121-2: Integrate encryption algorithms whose execution time is longer than that of the basic algorithms into an algorithm set; S121-3: Select an encryption algorithm with similar power consumption waveform and electromagnetic signal to the basic algorithm from the algorithm set as the target algorithm.

[0061] When matching the target algorithm, the primary criterion is that its execution time must be greater than that of the base algorithm. This is because the time obfuscation unit can only achieve obfuscation by extending the actual execution time, but cannot shorten the execution time of the encryption algorithm. Therefore, it is necessary to ensure that the execution time of the target algorithm is greater than that of the base algorithm. At the same time, the power consumption waveform and electromagnetic signal are similar to the relevant data of the base algorithm. This minimizes the difficulty of data processing during the simulation and improves simulation efficiency.

[0062] When matching encryption algorithms with power consumption waveforms and electromagnetic signals similar to those of the basic algorithm, the similarity of the power consumption waveforms can be compared first, and then the similarity of the electromagnetic signals can be compared. For example, encryption algorithms with execution times greater than the execution time of the basic algorithm can be integrated into algorithm set one; the similarity between the power consumption waveforms of each encryption algorithm in algorithm set one and the power consumption waveform of the basic algorithm can be compared to see if it is greater than a pre-set similarity threshold. If so, the corresponding encryption algorithms can be integrated into algorithm set two; the similarity between the electromagnetic signals of each encryption algorithm in algorithm set two and the electromagnetic signals of the basic algorithm can be compared, and the algorithm with the greatest similarity can be selected as the target algorithm. Of course, the reverse is also possible: first compare the electromagnetic signals, and integrate the encryption algorithms with similarities greater than the pre-set similarity threshold into algorithm set two. Then, select the encryption algorithm with the greatest power consumption waveform similarity from the algorithm combination as the target algorithm.

[0063] It should be noted that since the electromagnetic signal simulation in this invention involves shielding before simulation, it has little correlation with the actual electromagnetic signal. Therefore, there is no requirement for a data correlation between the electromagnetic signal of the base algorithm and the electromagnetic signal of the target algorithm. Furthermore, it is necessary to ensure that the parameters corresponding to the target algorithm can be simulated based on the parameters of the base algorithm, and if necessary (during internal simulation), the operating parameters of the obfuscation control module must also be considered.

[0064] In a preferred embodiment, an encryption algorithm having a power consumption waveform and an electromagnetic signal similar to those of a basic algorithm is selected from an algorithm set as a target algorithm, including: S121-3-1: Extract the average memory usage of each encryption algorithm in the algorithm set during power consumption simulation and electromagnetic simulation; S121-3-2: The reciprocal of the average memory usage is normalized and used as the weight coefficient for power consumption simulation and electromagnetic simulation; S121-3-3: Calculate the similarity of power consumption waveforms and electromagnetic signals between each encryption algorithm in the algorithm set and the basic algorithm; perform weighted calculation on the similarity and weight to obtain a comprehensive score, and select the encryption algorithm with the largest comprehensive score as the target algorithm.

[0065] The target algorithm can also be selected through a weighted calculation. Specifically, the average memory usage corresponding to the power consumption simulation and the electromagnetic simulation is measured, and the inverse of the average memory usage is normalized and used as the weight coefficient between the two. The similarity between the power consumption waveform and electromagnetic signal of each encryption algorithm in the aforementioned algorithm set 1 and the basic algorithm is calculated. The similarity is weighted with the weight coefficient to obtain a comprehensive index. The encryption algorithm with the largest comprehensive index is selected as the target algorithm.

[0066] It is understandable that any of the power simulation units, electromagnetic simulation units, or time simulation units in the obfuscation control unit will consume a certain amount of power when operating. If the obfuscation control unit is externally simulated relative to the drone chip, that is, the simulation process does not require the drone chip to be performed, then the power consumption of the simulation process can be ignored. However, if the simulation process is run by the drone chip, the power consumption required for its simulation will ultimately be reflected on the power pin of the drone chip. Therefore, in order to simulate the characteristics of other encryption algorithms, the power consumption of the simulation process needs to be taken into account. That is, the power consumption measured at the drone chip power pin includes real power consumption and simulated power consumption. The real power consumption is the sum of the power consumption of the drone chip performing encryption operations and the power consumption of electromagnetic simulation and time simulation. The simulated power consumption is the simulation result of the power simulation unit. After the real power consumption and simulated power consumption are dynamically superimposed, they should be similar to the power consumption waveform of other encryption algorithms to achieve the purpose of obfuscation.

[0067] See also Figure 3 In a preferred embodiment, performing directional analog obfuscation on the side channel characteristic parameters includes: S122-1: Real-time monitoring of the actual power consumption in the drone chip power circuit, extracting the target power consumption of the target algorithm when processing data; power consumption simulation based on the target power consumption and actual power consumption, achieving directional power consumption obfuscation of the power consumption waveform; S122-2: Shielding electromagnetic signals; generating electromagnetic confusion signals according to the electromagnetic signals of the target algorithm, radiating the electromagnetic confusion signals into space, and completing directional analog confusion of the electromagnetic signals; S122-3: Dynamically change the main clock frequency according to the instruction cycle time data of the target algorithm; generate a random phase offset sequence, and phase modulate the clock signal based on the random phase offset sequence; start irrelevant tasks, change the time consumption distribution, and achieve directional simulation obfuscation of execution time.

[0068] After selecting the target algorithm, the obfuscation control module can be used to perform obfuscation processing when the drone chip encrypts sensitive data according to the basic algorithm. The power obfuscation unit in the obfuscation control module is responsible for obfuscating the power consumption waveform of the drone chip's power pin into the power consumption waveform when processing sensitive data using the target algorithm. The electromagnetic obfuscation unit actively blocks the electromagnetic signals processed according to the basic algorithm, while simulating the electromagnetic radiation signals of the target algorithm and diffusing them into space. The time obfuscation unit prolongs the time the drone chip processes sensitive data according to the basic algorithm to the time it takes to process the target data according to the target algorithm.

[0069] When the drone begins processing sensitive data, the obfuscation process begins, with the power obfuscation unit, electromagnetic obfuscation unit, and time obfuscation unit in the obfuscation control module operating synchronously. The typical algorithm feature unit in the obfuscation control module sends the target algorithm's power consumption waveform to the power obfuscation unit, the electromagnetic signal to the electromagnetic obfuscation unit, and the execution time to the time obfuscation unit.

[0070] In a preferred embodiment, during external simulation, power consumption simulation is performed based on target power consumption and actual power consumption, including: S122-1-1: Extract actual power consumption and target power consumption; S122-1-2: The power consumption difference between the target power consumption and the actual power consumption is used as the power consumption simulation quantity; the power consumption simulation quantity is simulated to achieve directional simulation confusion of the power consumption waveform.

[0071] It's worth noting that the confusion control module can be simulated externally or internally. The difference between the two lies in whether the entire simulation process is run by the drone chip. For external simulation, the simulation process of the confusion control module is not run by the drone chip, and the energy consumed by the simulation process will not affect the detection results of the drone chip's power pins. If the simulation process of the confusion control module is run by the drone chip, that is, internal simulation, the energy consumption of the confusion control module simulation process will also be reflected on the drone chip's power pins. Therefore, this energy consumption needs to be taken into account when performing power consumption simulation to ensure that the simulation results are the same or similar to the power consumption waveform of the target algorithm.

[0072] When the confusion control module detects that the drone chip is processing sensitive data, it controls the power consumption confusion unit, electromagnetic confusion unit and time confusion unit to work.

[0073] When the obfuscation control module uses external simulation to perform obfuscation, each obfuscation unit can work independently. The specific working steps are as follows: Power consumption obfuscation unit: monitors the actual power consumption in the drone chip power circuit in real time. The actual power consumption refers to the power consumption of the drone chip when using the basic algorithm to encrypt sensitive data. At the same time, it extracts the power consumption of the target algorithm when processing data. The power consumption corresponding to the target algorithm minus the actual power consumption is the required simulated power consumption. The dynamic load regulator uses programmable resistors / capacitors to simulate this power consumption to achieve power consumption obfuscation.

[0074] The electromagnetic confusion unit monitors the actual electromagnetic signal on the drone chip's surface in real time, converts it to the frequency domain through FFT, and extracts the characteristic frequency components. The DSP performs amplitude inversion and 180° phase shifting on the actual electromagnetic signal to generate control parameters for signal cancellation. The near-field shielding antenna transmits an inverted signal based on the weight coefficients output by the DSP, forming an electromagnetic null region on the chip's surface. Simultaneously, the electromagnetic radiation simulator generates an electromagnetic confusion signal based on the electromagnetic signal of the target algorithm. This confusion signal is radiated into space through the far-field interference antenna. The intensity of the electromagnetic confusion signal must match the power spectrum density of the drone chip's actual electromagnetic radiation.

[0075] Time Obfuscation Unit: When the drone chip processes sensitive data, the programmable clock divider dynamically changes the master clock frequency based on the target algorithm's instruction cycle timing data. A phase modulator randomly adjusts the clock signal phase, making the timing relationship between adjacent instruction cycles irregular, further complicating analysis by attackers. The CPU pipeline is monitored in real time. When a sensitive instruction enters the decoding phase, one to three invalid instructions are randomly inserted before and after the sensitive instruction to delay its execution. Sensitive operations such as encryption rounds can also be repeated, retaining only the last result. When an encryption operation is initiated, the parallel operation scheduler selects one to three tasks from the unrelated task queue and executes them in parallel with the sensitive operation.

[0076] It's worth noting that before the obfuscation control module begins obfuscation, it needs to extract the target algorithm's corresponding power consumption waveform, electromagnetic signal, and execution time. Since the key derivation based on power consumption, electromagnetic signals, and execution time is irrelevant to whether the data corresponds to sensitive data, the target algorithm's power consumption waveform, electromagnetic signal, and execution time do not need to correspond to sensitive data. These parameters can be obtained by simulating pre-set simulation data using the target algorithm.

[0077] In a preferred embodiment, during internal simulation, power consumption simulation is performed based on target power consumption and actual power consumption, including: S122-2-1: Extract the actual power consumption and target power consumption, and monitor the power consumption of the directional hybrid simulation in real time, marking it as additional power consumption. S122-1-2: The power consumption difference between the target power consumption and the actual power consumption and the additional power consumption is taken as the power consumption simulation value; the power consumption simulation value is generated by simulation to achieve directional simulation confusion of the power consumption waveform.

[0078] When the obfuscation control module uses internal simulation for obfuscation, each obfuscation unit can operate independently. Compared with external simulation, the power consumption obfuscation unit in internal simulation must consider the energy consumption of each obfuscation unit to ensure that the simulated power consumption waveform is consistent with the power consumption waveform of the target algorithm. The working steps of the electromagnetic obfuscation unit and the time obfuscation unit remain basically unchanged. The working steps of the power consumption obfuscation unit are as follows: Power consumption obfuscation unit: monitors the actual power consumption in the drone chip power supply circuit in real time. The actual power consumption refers to the power consumption of the drone chip when using the basic algorithm to encrypt sensitive data, as well as the energy consumption corresponding to the operation of each obfuscation unit (which can be measured by the on-chip power consumption sensor); at the same time, the power consumption of the target algorithm when processing data is extracted; the power consumption corresponding to the target algorithm minus the actual power consumption and the energy consumption of each obfuscation unit when working is the required simulated power consumption. The dynamic load regulator uses programmable resistors / capacitors to simulate this power consumption to achieve power consumption obfuscation.

[0079] The above embodiments are only used to illustrate the technical method of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A method for controlling access to sensitive data on drone chips based on a trusted execution environment, characterized in that: include: Configure a trusted execution environment for the drone; Check whether the drone chip performs data encryption; Yes, start real-time obfuscation processing of the side channel characteristic parameters of the encryption process; the real-time obfuscation processing content includes power consumption, electromagnetic signals and execution time.

2. The method for controlling access to sensitive data of drone chips based on a trusted execution environment according to claim 1 is characterized in that: Performing real-time obfuscation processing on the side channel characteristic parameters, including: When an obfuscated instruction is detected, the side channel characteristic parameters of the drone chip are detected in real time; the side channel characteristic parameters include power consumption waveform, electromagnetic signal and execution time; Random simulation obfuscation is performed on the side channel characteristic parameters.

3. The method for controlling access to sensitive data of drone chips based on a trusted execution environment according to claim 2 is characterized in that: Performing random simulation confusion on the power consumption waveform, including: Marking the power consumption waveform as basic power consumption; Generate random power consumption, dynamically superimpose the random power consumption with the basic power consumption, and complete random simulation confusion of power consumption.

4. The method for controlling access to sensitive data of drone chips based on a trusted execution environment according to claim 2 is characterized in that: Performing random simulation obfuscation on the electromagnetic signal, comprising: shielding the electromagnetic signal; An electromagnetic confusion signal is generated and radiated into space to complete random simulated confusion of the electromagnetic signal.

5. The method for controlling access to sensitive data of drone chips based on a trusted execution environment according to claim 2 is characterized in that: Perform random simulation obfuscation on the execution time, including: Dynamically change the main clock frequency; generating a random phase offset sequence, and performing phase modulation on a clock signal based on the random phase offset sequence; Start irrelevant tasks, change the time consumption distribution, and achieve random simulation confusion of execution time.

6. The method for controlling access to sensitive data of drone chips based on a trusted execution environment according to claim 1 is characterized in that: Performing real-time obfuscation processing on the side channel characteristic parameters, including: When an obfuscated instruction is detected, the side channel characteristic parameters of the drone chip are detected in real time; the side channel characteristic parameters include power consumption waveform, electromagnetic signal and execution time; Directional simulation obfuscation is performed on the side channel characteristic parameters.

7. The method for controlling access to sensitive data of a drone chip based on a trusted execution environment according to claim 6 is characterized in that: Before performing the directed simulation obfuscation, select a target algorithm, including: Determine the basic algorithm corresponding to data encryption; The encryption algorithms whose execution time is longer than that of the basic algorithms are integrated into an algorithm set; An encryption algorithm having a power consumption waveform and an electromagnetic signal similar to those of the basic algorithm is selected from the algorithm set as a target algorithm.

8. The method for controlling access to sensitive data of a drone chip based on a trusted execution environment according to claim 6 is characterized in that: Performing directional simulation obfuscation on the side channel characteristic parameters, including: Real-time monitoring of the actual power consumption in the drone chip power circuit, extracting the target power consumption of the target algorithm when processing data; power consumption simulation based on the target power consumption and the actual power consumption, achieving directional power consumption obfuscation of the power consumption waveform; Shielding the electromagnetic signal; generating an electromagnetic confusion signal according to the electromagnetic signal of the target algorithm, radiating the electromagnetic confusion signal into space, and completing directional simulation confusion of the electromagnetic signal; The main clock frequency is dynamically changed according to the instruction cycle time consumption data of the target algorithm; a random phase offset sequence is generated, and the phase of the clock signal is modulated based on the random phase offset sequence; irrelevant tasks are started, the time consumption distribution is changed, and directional simulation obfuscation of the execution time is achieved.

9. The method for controlling access to sensitive data of a drone chip based on a trusted execution environment according to claim 8 is characterized in that: During external simulation, power consumption simulation is performed based on the target power consumption and the actual power consumption, including: extracting the actual power consumption and the target power consumption; The power consumption difference between the target power consumption and the actual power consumption is used as a power consumption simulation quantity; the power consumption simulation quantity is generated by simulation to achieve directional simulation confusion of the power consumption waveform.

10. The method for controlling access to sensitive data of a drone chip based on a trusted execution environment according to claim 8, characterized in that: During internal simulation, power consumption simulation is performed based on the target power consumption and the actual power consumption, including: Extracting the actual power consumption and the target power consumption, and monitoring the power consumption consumed by the directional hybrid simulation in real time, marking it as additional power consumption, The power consumption difference between the target power consumption and the actual power consumption and the additional power consumption is taken as a power consumption simulation quantity; the power consumption simulation quantity is generated by simulation to achieve directional simulation confusion of the power consumption waveform.

Images