Side channel analysis method based on convolutional auto-encoder and parallel analysis model
By reconstructing trajectory curves using a convolutional autoencoder and building a parallel analysis model, combined with a custom loss function and fusion algorithm, the key recovery problem under data-constrained conditions was solved, achieving efficient and stable key recovery results.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-24
- Publication Date
- 2026-03-10
AI Technical Summary
Existing side-channel analysis methods struggle to recover keys effectively under data-constrained conditions, and existing model fusion schemes suffer from uncertainty in feature extraction and noise redundancy, leading to unstable analysis performance.
A convolutional autoencoder is used to reconstruct the trajectory curve and build a parallel analysis model. A custom loss function and a pre-trained model are used to guide the training. The key is recovered through a weighted average and sorted fusion algorithm.
It significantly improves attack efficiency and success rate under conditions of a small number of curves, enhances the accuracy and robustness of key recovery, reduces dependence on the number of curves, and ensures the purity and efficiency of the feature space.
Smart Images
Figure CN121644052A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of cryptanalysis, and particularly relates to a side channel analysis method based on a convolutional autoencoder and a parallel analysis model. BACKGROUND
[0002] As an effective means of security evaluation of cryptographic chips, the successful implementation of typical methods (such as differential power analysis DPA, correlation power analysis CPA, etc.) of side channel analysis fundamentally depends on the collection of a sufficient number of power consumption or electromagnetic radiation curves. The prior art usually needs to extract weak key-related signals from strong noise through statistical processing such as averaging, which leads to the fact that in actual attacks, thousands or even tens of thousands of curves are often needed to successfully recover the key. However, this dependence on a large number of curves has become the main bottleneck of this technology in practical applications: on the one hand, as the protection technology of cryptographic chips is increasingly enhanced (such as through the addition of hardware noise, the implementation of randomization, etc. countermeasures), the signal-to-noise ratio of effective information is further reduced, causing the number of curves required to increase exponentially, greatly increasing the time and cost of analysis; on the other hand, in many actual security evaluation and attack scenarios, limited by the access time of the device, the collection conditions or the characteristics of the target system, the attacker may only be able to obtain a few hundred or even fewer effective curves. In this "data-limited" scenario, the traditional analysis method based on the statistical characteristics of a large number of curves will be completely ineffective due to insufficient data, and cannot extract any effective key information from it.
[0003] In addition, the existing side channel analysis scheme based on model fusion usually adopts the method of directly splicing the outputs of multiple base models in the feature space. This method has essential limitations: first, the generation of base models depends on the random configuration of hyperparameters, resulting in a high degree of uncertainty and blindness in the feature extraction ability and direction of the base models, and there may be serious conflicts and redundancies between the extracted features; second, although simple feature splicing increases the data dimension in form, it does not fundamentally increase the diversity of effective information, and may even lead to a decrease in the model generalization ability due to the introduction of a large number of irrelevant noise features. Therefore, the existing fusion scheme not only has a limited and unstable improvement in attack efficiency, but may even perform worse than a single model in terms of analysis performance due to the deterioration of the feature space. SUMMARY
[0004] The application provides a side channel analysis method based on a convolutional autoencoder and a parallel analysis model, including: collecting an initial trajectory curve of a target device, the initial trajectory curve being an unknown attack trajectory curve, and the target device being a to-be-attacked device containing a key; inputting the initial trajectory curve into a preset convolutional autoencoder to obtain a target trajectory curve, the target trajectory curve and the initial trajectory curve both containing the same key features; inputting the target trajectory curve into a second network model pre-trained, and inputting the initial trajectory curve into a first network model pre-trained to obtain a second attack result and a first attack result respectively; and fusing the second attack result and the first attack result based on a preset fusion algorithm to obtain the key of the target device; wherein the second network model is a model obtained by training based on the first network model using a self-defined loss function.
[0005] In the above scheme, the convolutional autoencoder includes a symmetric structure composed of an encoder and a decoder, the initial trajectory curve is input into the preset convolutional autoencoder to obtain the target trajectory curve, including: using the encoder to map the initial trajectory curve into a latent feature vector; and using the decoder to reconstruct the latent feature vector into a target trajectory curve with the same dimension as the initial trajectory curve.
[0006] In the above scheme, the first network model and the second network model are convolutional neural networks with the same structure and independent weights.
[0007] In the above scheme, the training process of the first network model includes: constructing a convolutional neural network architecture of the first network model and initializing; obtaining an initial trajectory training data set; inputting the initial trajectory training data set into the constructed convolutional neural network for training to obtain the trained first network model.
[0008] In the above scheme, the training process of the second network model includes: reconstructing the initial trajectory training data set into a target trajectory training data set based on the preset convolutional autoencoder; constructing a convolutional neural network architecture of the second network model and initializing; inputting the target trajectory training data set into the constructed convolutional neural network for training to obtain the trained second network model.
[0009] In the above scheme, the training process of the second network model further includes training based on the first network model using a self-defined loss function, and the self-defined loss function is:
[0010]
[0011] wherein, is a standard cross-entropy loss, is a penalty term weight coefficient, is a penalty term, wherein is the sum of log probabilities of the first network model and the second network model on the error label, is the sum of log probabilities of the first network model and the second network model on the correct label.
[0012] In the above scheme, the self-defined loss function is used for guided training based on the first network model, including: dynamically calculating a target number of interference labels jointly identified by the first network model and the second network model; based on the penalty term of the loss function, the combination log probability value of the target number of interference labels is lower than the log probability value of the correct label.
[0013] In the above scheme, the second attack result and the first attack result are fused based on a preset fusion algorithm to obtain the key of the target device, including: using a preset weighted average algorithm to fuse the second attack result and the first attack result to obtain the key of the target device; wherein the weight in the weighted average algorithm is dynamically allocated according to the performance of the first network model and the second network model.
[0014] In the above scheme, the second attack result and the first attack result are fused based on a preset fusion algorithm to obtain the key of the target device, including: using a preset weighted average algorithm to fuse the second attack result and the first attack result to obtain the key of the target device; wherein the weight in the weighted average algorithm is dynamically allocated according to the performance of the first network model and the second network model.
[0015] The technical scheme of the embodiment of the application has at least the following beneficial effects:
[0016] (1) The method can greatly reduce the dependence on the number of curves, and under the condition of using only a small number of curves, through data processing of the convolutional autoencoder and construction of the network analysis model, the same attack efficiency and success rate as the traditional method under a large number of curves are realized, thereby significantly improving the applicability of side channel analysis under real harsh conditions.
[0017] (2) The convolutional autoencoder is used to reconstruct the initial trajectory with high quality, and the target trajectory generated by reconstruction is homologous and consistent with the initial trajectory in key features, which fundamentally ensures the originality of the input features of the parallel analysis network. At the same time, the deterministic difference introduced in the reconstruction process provides a complementary "data perspective", realizing directional and controllable data reuse and feature enhancement, rather than simply random stacking, thereby ensuring the purity and efficiency of the feature space.
[0018] (3) The guiding training mechanism and the self-defined loss function of model training are proposed, the mechanism can actively identify the most stubborn multiple interference labels identified by the initial pre-training model (i.e. the first network model) and the current trained convolutional autoencoder model (i.e. the second network model) together, and suppress them accurately through the penalty term. This process is equivalent to providing navigation for model optimization, changing from broad spectrum learning to "precision guidance", forcing the model to form a more discriminative decision boundary, thereby directly and efficiently improving the accuracy and robustness of key recovery.
[0019] (4) The target trajectory curve generated by the convolutional autoencoder in the attack stage is dynamically reconstructed, and the limited initial trajectory curve forms a complementary joint attack set. This "online dynamic enhancement" mechanism enables the construction of a rich and diverse analysis environment with only a small amount of real trajectory in the attack site, significantly reducing the dependence on the number of trajectories in the attack stage, and greatly improving the attack efficiency and practicality under small sample conditions. Effectively solves the core technical problem that the existing technology still relies heavily on a large number of real trajectories to ensure success rate in the attack stage.
[0020] (5) Through the constructed parallel analysis network, due to the homogeneity and complementarity of the input data, the performance improvement is stable and interpretable. Combined with active guiding training, the tolerance to noise and interference is higher. Therefore, stable and significant performance improvement can be achieved on various public data sets, avoiding the risk of performance deterioration with the increase of base model number in the existing technology. BRIEF DESCRIPTION OF DRAWINGS
[0021] Figure 1 The flowchart of the side channel analysis method based on the convolutional autoencoder and the parallel analysis model according to the embodiment of the present application is schematically shown.
[0022] Figure 2 The training flowchart of the first network model and the second network according to the embodiment of the present application is schematically shown. DETAILED DESCRIPTION
[0023] In order to make the purpose, technical scheme and advantages of the present application more clear, the present application is further described in detail below in combination with specific embodiments and with reference to the drawings.
[0024] Figure 1 The flowchart of the side channel analysis method based on the convolutional autoencoder and the parallel analysis model according to the embodiment of the present application is schematically shown.
[0025] Please refer to Figure 1 The specific process of the side channel analysis method based on the convolutional autoencoder and the parallel analysis model according to the embodiment of the present application includes operations S110-S140.
[0026] In operation S110, an initial trajectory curve of a target device is collected, the initial trajectory curve being an unknown attack trajectory curve, and the target device being a device to be attacked containing a key.
[0027] In embodiments of the present application, in order to perform side channel analysis on a target device running at runtime to recover the key of the target device, the target device is a device to be attacked containing a key.
[0028] For example, the target device is a cryptographic device, which leaks certain physical information such as power consumption, electromagnetic radiation, execution time, etc. when running. When performing side channel analysis on the cryptographic device, a certain number of power consumption or electromagnetic radiation curves of the cryptographic device are collected, which are initial trajectory curves.
[0029] It can be understood that for the cryptographic device that needs to be subjected to side channel analysis, the cryptographic device is a device to be attacked, and the initial trajectory curve collected is an unknown attack trajectory curve. By analyzing and processing the attack trajectory curve, the key is recovered. The analysis and processing of the attack trajectory curve are described in detail below.
[0030] In operation S120, the initial trajectory curve is input into a preset convolutional autoencoder to obtain a target trajectory curve, and the initial trajectory curve and the target trajectory curve both contain the same key features.
[0031] In embodiments of the present application, the convolutional autoencoder includes a symmetric structure composed of an encoder and a decoder. The initial trajectory curve is input into the preset convolutional autoencoder to obtain the target trajectory curve, which includes: using the encoder to map the initial trajectory curve to a latent feature vector; and using the decoder to reconstruct the latent feature vector into a target trajectory curve with the same dimension as the initial trajectory curve.
[0032] Specifically, the convolutional autoencoder adopts a symmetric structure of an encoder-decoder, wherein the encoder is composed of a plurality of one-dimensional convolutional layers and pooling layers stacked together to map the input initial trajectory curve from a high-dimensional space to a low-dimensional latent feature space. This process forces the network to learn and retain the essential features in the trajectory that are most relevant to the key information, while filtering out a large amount of irrelevant noise.
[0033] Further, the decoder is composed of a plurality of one-dimensional up-sampling layers and convolutional layers stacked together, which receives the latent feature vector output by the encoder and reconstructs it into a target trajectory curve with the same dimension as the initial trajectory curve.
[0034] It can be understood that the target trajectory curve and the initial trajectory curve both contain the same key features. Through the constraint of this lossy reconstruction, the convolutional autoencoder is trained to be an efficient feature extractor. The reconstructed trajectory is not a simple copy of the initial data, but an explicit expression of its key features after nonlinear transformation. This ensures the consistency of the generated data and the initial data in the feature source, while introducing new feature perspectives and subtle differences that the model considers "reasonable".
[0035] Through the embodiments of the present application, the initial trajectory is reconstructed with high quality by using the convolutional autoencoder, and the reconstructed target trajectory is consistent with the initial trajectory in key features, which fundamentally ensures the originality of the input features of the parallel analysis network. At the same time, the deterministic differences introduced in the reconstruction process provide complementary "data perspectives", realizing directional and controllable data reuse and feature enhancement, rather than simply random stacking, thereby ensuring the purity and efficiency of the feature space. The problems in the prior art are effectively solved, for example, in the prior art, multiple base models are randomly generated and feature splicing is performed, and the feature extraction process is blind, resulting in a large amount of redundant and conflicting information in the fused feature space, which not only cannot form effective complementarity, but also may dilute the key features, resulting in limited or even decreased performance.
[0036] In operation S130, the target trajectory curve is input into the pre-trained second network model, and the initial trajectory curve is input into the pre-trained first network model, to obtain a second attack result and a first attack result, respectively. The second network model is a model trained based on the first network model using a self-defined loss function.
[0037] Figure 2 The training flowchart of the first network model and the second network according to the embodiments of the present application is schematically shown.
[0038] In the embodiments of the present application, the first network model and the second network model are both convolutional neural networks with the same structure and independent weights. First, the training process of the first network model and the second network model will be described in detail.
[0039] Specifically, the training process of the first network model includes: constructing a convolutional neural network architecture of the first network model and initializing, obtaining an initial trajectory training data set, inputting the initial trajectory training data set into the constructed convolutional neural network for training, and obtaining a trained first network model. It should be noted that in the embodiments of the present application, the initial trajectory training data set can be a historical trajectory data set of the target device, or a public data set.
[0040] Specifically, the training process of the second network model comprises: reconstructing the initial trajectory training dataset into a target trajectory training dataset based on the preset convolutional autoencoder, constructing and initializing a convolutional neural network architecture of the second network model, inputting the target trajectory training dataset into the constructed convolutional neural network for training, and obtaining the trained second network model.
[0041] It should be noted that, as Figure 2 indicated, the input of the training data of the second network model here is the target trajectory training set obtained after the initial trajectory training dataset is processed by the convolutional autoencoder.
[0042] Further, the training process of the second network model further comprises guiding training based on the first network model by using a self-defined loss function. Wherein, the self-defined loss function is:
[0043]
[0044] Wherein, is a standard cross-entropy loss, is a penalty term weight coefficient, is a penalty term, , wherein is the sum of the log probabilities of the first network model and the second network model on the wrong labels, is the sum of the log probabilities of the first network model and the second network model on the correct labels.
[0045] Wherein, the guiding training based on the first network model by using the self-defined loss function comprises: dynamically calculating a target number of interference labels jointly identified by the first network model and the second network model, and making the combination log probability value of the target number of interference labels lower than the log probability value of the correct label based on the penalty term of the loss function.
[0046] Specifically, as Figure 2 indicated, the first network model and the second network model are two parallel networks, the input end of the second network model is connected to the target trajectory training set generated by the convolutional autoencoder reconstruction, and the target trajectory training set is used for training. The parallel networks learn the key-related leakage features from two complementary perspectives of "initial view" and "reconstruction view". In order to ensure that the network model can focus more accurately on the correct key and effectively suppress the interference term, the "reconstruction view" model (i.e. the second network model) of the embodiment introduces an additional guiding training phase by the first network model outside the normal training period.
[0047] This phase adopts a self-defined loss function, which is defined as follows:
[0048]
[0049] wherein, is a standard cross-entropy loss, is a penalty term weight coefficient, is a penalty term.
[0050] In embodiments of the present application, the penalty term is designed based on a combined log-probability penalty mechanism. Specifically, through this mechanism, the top number of interfering labels (i.e., high-probability incorrect key candidates, which can be, for example, the top 5 interfering labels) with the highest probabilities jointly identified by the initial pre-trained model (i.e., the first network model) and the currently trained convolutional autoencoder model (i.e., the second network model) are dynamically calculated.
[0051] It can be understood that the penalty term here is equivalent to imposing a gradient that forces the combined log-probability values of these identified Top-5 interfering labels to be lower than the log-probability value of the correct label. This process is mathematically expressed as:
[0052]
[0053] wherein is the sum of the log-probabilities of the first network model and the second network model on the incorrect label, is the sum of the log-probabilities of the first network model and the second network model on the correct label.
[0054] It can be understood that the present embodiment proposes a guided training mechanism and a self-defined loss function, which can actively identify the most stubborn multiple interfering labels jointly identified by the historical model and the current model, and precisely suppress them through the penalty term. This process is equivalent to providing a "navigation" for model optimization, changing from "broad spectrum learning" to "precision guidance", forcing the model to form a decision boundary with stronger discrimination, thereby directly and efficiently improving the accuracy and robustness of key recovery. The problems in the prior art are effectively solved. Existing solutions and traditional training methods use standard loss functions (such as cross-entropy), and the optimization process is relatively passive and extensive, making it difficult to effectively distinguish and suppress those high-probability interfering key candidates.
[0055] Through embodiments of the present application, through this directional penalty, the loss function not only strives to improve the probability of the correct label in the optimization process, but also actively and selectively suppresses those most stubborn and most deceptive competitive incorrect labels, thereby guiding the model to form a decision boundary with stronger discrimination, significantly improving the attack accuracy in a complex interference environment.
[0056] It can be understood that the data enhancement realized by the convolutional autoencoder in the embodiment is directed, feature-preserving data reuse, and the guided training realized by the self-defined loss function is accurate and anti-interference model optimization. The combination of the two not only realizes expansion and purification at the data level, but also realizes accurate guidance at the model optimization level, so that the entire system can make more sufficient and efficient use of limited initial data, solving the problem of sharp performance decline of traditional methods in data deficiency.
[0057] Based on the above, after obtaining the trained first network model and the second network model, the key recovery with high analysis performance is realized based on the parallel analysis network (i.e. the trained first network model and the second network model). Specifically, the initial trajectory curve of the cryptographic device to be attacked collected above is input into the pre-trained first network model for attack, and a first attack result is obtained. The target trajectory curve obtained by extracting and reconstructing the initial trajectory curve of the cryptographic device to be attacked by the convolutional autoencoder is input into the pre-trained second network model for attack, and a second attack result is obtained. Finally, fusion processing of the first attack result and the second attack result is performed, thereby realizing key recovery with high analysis performance.
[0058] It can be understood that the target trajectory curve generated by the convolutional autoencoder in the attack stage is dynamically reconstructed, which forms a complementary joint attack set with the limited initial trajectory curve. This "online dynamic enhancement" mechanism enables the construction of a rich and diverse analysis environment from a small amount of real trajectory in the attack site, significantly reducing the dependence on the number of trajectories in the attack stage and greatly improving the attack efficiency and practicality under small sample conditions. The problems in the prior art are effectively solved. For example, the prior art is an offline and static model optimization, and its performance is fixed after training. It still relies heavily on a large number of real trajectories to ensure success rate in the attack stage, and cannot solve the core technical problem of "lack of data in the attack stage".
[0059] The fusion processing of the first attack result and the second attack result is described in detail below.
[0060] In operation S140, the second attack result and the first attack result are fused based on a preset fusion algorithm to obtain the key of the target device.
[0061] In the embodiment of the application, the second attack result and the first attack result are fused based on a preset fusion algorithm to obtain the key of the target device, including: the second attack result and the first attack result are fused based on a preset weighted average algorithm to obtain the key of the target device; wherein the weight in the weighted average algorithm is dynamically allocated according to the performance of the first network model and the second network model.
[0062] In the embodiment of the present application, the second attack result and the first attack result are fused based on a preset fusion algorithm to obtain the key of the target device, including: using a preset ranking fusion method to rank the guess entropy of the second attack result and the guess entropy of the first attack result to determine the key of the target device.
[0063] Specifically, the attack results output from the first network model and the second network model respectively are obtained, and the attack results are the probability distribution of key candidate values.
[0064] Exemplarily, the key candidate value probabilities output by the two network models are fused. The fusion strategy can adopt a weighted average method, and the weights can be dynamically allocated according to the performance of each network on the validation set; or adopt a ranking fusion method to sort the guess entropy of the two networks to obtain the final optimal key candidate.
[0065] Through the embodiment of the present application, by fusing the output results of two models with differences but correlations, the prediction bias that a single model may produce can be smoothed, so that a more stable and reliable final result (i.e. the key of the target device) is obtained. This significantly improves the key recovery success rate and robustness under harsh conditions such as limited data volume and serious noise interference.
[0066] It can also be understood that the parallel analysis network constructed in the embodiment has stable and interpretable performance improvement due to the homology and complementarity of the input data. Combined with active guided training, the system has higher tolerance to noise and interference. Therefore, stable and significant performance improvement can be achieved on various public data sets, avoiding the risk that the performance may deteriorate with the increase of the number of base models in the prior art. The performance fluctuation of the random fusion scheme in the prior art is effectively solved, and sometimes the increase in the number of fusion base models may lead to performance degradation due to noise feature accumulation, and lacks stability and predictability.
[0067] The above specific embodiments further detail the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above are only specific embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.
Claims
1. A side-channel analysis method based on a convolutional autoencoder and a parallel analysis model, characterized in that, The method comprises: collecting an initial trajectory curve of a target device, the initial trajectory curve being an unknown attack trajectory curve, and the target device being a device to be attacked containing a key; inputting the initial trajectory curve into a preset convolutional autoencoder to obtain a target trajectory curve, the initial trajectory curve and the target trajectory curve both containing the same key features; inputting the target trajectory curve into a pre-trained second network model and inputting the initial trajectory curve into a pre-trained first network model to obtain a second attack result and a first attack result respectively; based on a preset fusion algorithm, fusing the second attack result and the first attack result to obtain the key of the target device; wherein the second network model is a model obtained by training based on the first network model using a self-defined loss function.
2. The side-channel analysis method based on a convolutional autoencoder and a parallel analysis model according to claim 1, characterized in that, The convolutional autoencoder comprises a symmetric structure composed of an encoder and a decoder, and the inputting of the initial trajectory curve into the preset convolutional autoencoder to obtain the target trajectory curve comprises: mapping the initial trajectory curve into a latent feature vector using the encoder; reconstructing the latent feature vector into a target trajectory curve with the same dimension as the initial trajectory curve using the decoder.
3. The side-channel analysis method based on convolutional autoencoder and parallel analytic model according to claim 1, wherein, The first network model and the second network model are convolutional neural networks with the same structure and independent weights.
4. The side-channel analysis method based on convolutional autoencoder and parallel analytic model according to claim 1, wherein, The training process of the first network model comprises: building a convolutional neural network architecture of the first network model and initializing; obtaining an initial trajectory training data set; inputting the initial trajectory training data set into the built convolutional neural network for training to obtain the trained first network model.
5. The side-channel analysis method based on a convolutional autoencoder and a parallel analysis model according to claim 4, characterized in that, The training process of the second network model comprises: reconstructing the initial trajectory training data set into a target trajectory training data set based on the preset convolutional autoencoder; building a convolutional neural network architecture of the second network model and initializing; inputting the target trajectory training data set into the built convolutional neural network for training to obtain the trained second network model.
6. The side-channel analysis method based on a convolutional autoencoder and a parallel analysis model according to claim 5, characterized in that, The training process of the second network model further comprises training based on the first network model using a self-defined loss function. wherein, is a standard cross-entropy loss, is a weight coefficient of the penalty term, is a penalty term, the wherein, is the sum of log probabilities of the first network model and the second network model on the wrong label, is the sum of log probabilities of the first network model and the second network model on the correct label.
7. The side-channel analysis method based on a convolutional autoencoder and a parallel analysis model according to claim 6, characterized in that, The training based on the first network model using the self-defined loss function comprises: dynamically calculating a target number of interference labels jointly identified by the first network model and the second network model; based on a penalty term of the loss function, making the combination log probability value of the target number of interference labels lower than the log probability value of the correct label.
8. The side-channel analysis method based on convolutional autoencoder and parallel analytic model according to claim 1, wherein, The fusing of the second attack result and the first attack result based on the preset fusion algorithm to obtain the key of the target device comprises: fusing the second attack result and the first attack result based on a preset weighted average algorithm to obtain the key of the target device; wherein the weights in the weighted average algorithm are dynamically allocated according to the performance of the first network model and the second network model.
9. The side-channel analysis method based on convolutional autoencoder and parallel analytic model according to claim 1, wherein, The fusing of the second attack result and the first attack result based on the preset fusion algorithm to obtain the key of the target device comprises: The guess entropy of the second attack result and the guess entropy of the first attack result are sorted by using a preset sorting fusion method, and a key of the target device is determined.