Cross-device modeling side channel attack monitoring system and method based on adversarial learning
By using an adversarial training framework based on adversarial learning, the feature extraction model is optimized to learn device-invariant feature representations, which solves the performance degradation problem caused by device differences in cross-device modeling side-channel attacks, and achieves efficient cross-device attacks and accurate key recovery.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-21
- Publication Date
- 2026-03-31
AI Technical Summary
Existing deep learning methods suffer from performance degradation in cross-device modeling side-channel attacks due to device differences, affecting the portability and practicality of the attacks, and existing technologies struggle to effectively address this issue.
By employing adversarial learning, an adversarial training framework is constructed. The encoder and discriminator are used to optimize the feature extraction model, enabling it to learn device-invariant feature representations. The convergence state of the model is determined by combining latent space feature distribution analysis, thus enabling cross-device attacks.
It enables efficient attacks on different target devices, reduces the impact of device differences on model performance, improves the accuracy and efficiency of attacks, and reduces the dependence on target device labels.
Smart Images
Figure CN121770718A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information security technology, specifically to a cross-device modeling side-channel attack monitoring system and method based on adversarial learning. Background Technology
[0002] Modeling side-channel attacks pose a significant threat to cryptographic devices in embedded systems. In these attacks, attackers first utilize a controlled modeling device to construct a precise leak model, then use this model to launch attacks on similar target devices to recover their keys. In recent years, deep learning-based modeling attacks have demonstrated superior performance due to their ability to automatically handle high-dimensional, unaligned curve data.
[0003] However, existing deep learning methods face significant challenges in cross-device attack scenarios. In practical applications, even encryption devices of identical models can exhibit slight but not negligible differences in side-channel leakage due to inherent factors such as manufacturing processes and environmental noise—a phenomenon known as "device variation." This variation causes a high-precision model trained on one device to experience a sharp performance drop on another, rendering the attack completely ineffective. This problem severely restricts the portability and practicality of modeling side-channel attacks in real-world scenarios. To address this issue, existing techniques primarily rely on target device-specific preprocessing or training the model using multiple modeling devices. The former requires adjusting the preprocessing workflow for new targets, resulting in poor flexibility; the latter significantly increases the cost and complexity of the attack. Although some research has attempted to introduce transfer learning, it typically still requires partial target device labeling or relies on distributional difference measures that are difficult to optimize. Summary of the Invention
[0004] The purpose of this invention is to provide a cross-device modeling side-channel attack monitoring system and method based on adversarial learning, so as to solve the problems raised in the prior art.
[0005] To achieve the above objectives, the present invention provides the following technical solution: a cross-device modeling side-channel attack monitoring method based on adversarial learning, the method comprising: S100: Collect side-channel curve data of similar devices running the same encryption algorithm, and divide the devices into modeling devices and target devices; label the curve data of the modeling devices with encryption operation sensitive intermediate value labels, while the curve data of the target devices remains unlabeled. S200. Using labeled curve data from the modeling equipment, pre-train the curve feature extraction model to obtain a preliminary curve feature extraction model; the curve feature extraction model includes an encoder and a classifier. S300. Construct an adversarial training framework, which includes a preliminary curve feature extraction model and a discriminator; use the labeled curve of the modeling device and the unlabeled curve of the target device as input for iterative training. S400. In each iteration, the encoder extracts feature vectors from the curves of the two types of devices; the discriminator determines the source of the device based on the feature vectors and the output of the classifier; the parameters of the encoder and classifier are jointly optimized to minimize the modeling device classification error, maximize the discriminator's discrimination error, and learn the device-invariant feature representation. The relative distance or overlap of the features of the S500 real-time monitoring modeling device and the target device in the latent space; when the relative distance or overlap tends to stabilize and exceeds the preset threshold, the curve feature extraction model is determined to have converged. S600 uses a curve feature extraction model to analyze the attack curve of the target device, outputs the analysis key guessing score through a classifier, and recovers the correct key.
[0006] According to the above scheme, step S100 includes: S110. Set up a device set consisting of multiple encryption devices of the same model, with all devices in the device set running the same encryption algorithm; S120. Collect physical leakage signals while the encryption device is running and convert them into digital side-channel curve data; S130. Specify at least one device from the device set as the modeling device, and the remaining devices as the target devices; S140. During the encryption operation of the modeling device, record the sensitive intermediate values associated with the encryption key and plaintext, and label the Hamming weight or Hamming distance of the sensitive intermediate values onto the corresponding side channel curve data of the modeling device. S150. Collect the side channel curve data of the target device when running the encryption algorithm, and keep the side channel curve data of the target device when running the encryption algorithm in a tagless state.
[0007] According to the above scheme, step S200 includes: S210, the curve feature extraction model includes an encoder and a classifier; the encoder adopts a convolutional neural network structure to extract features from the input side-channel curve data and outputs a fixed-dimensional curve feature vector; the classifier adopts a fully connected neural network structure, based on the curve feature vector, to predict the encryption operation sensitive intermediate value label of the side-channel curve data and output the label prediction result. S220. Divide the labeled side-channel curve data of the modeling device into a training set and a validation set; S230. Supervised training of the curve feature extraction model is performed based on the training set. The output of the curve feature extraction model is analyzed by forward propagation, and the difference between the output and the true label is evaluated by using cross-entropy as the loss function. Before training, the labeled curve data of the modeling device is preprocessed. The preprocessing includes data normalization and temporal denoising. Data normalization maps the numerical range of all curve data to a preset interval to eliminate the magnitude difference between different curves. Temporal denoising uses a moving average filtering algorithm to filter out random noise introduced by the acquisition environment in the curve data to obtain a standardized labeled curve dataset. S240. Optimize the model parameters of the curve feature extraction model through the backpropagation algorithm, minimize the loss function, and monitor the performance of the curve feature extraction model on the validation set to prevent overfitting. S250. When the classification accuracy of the curve feature extraction model on the validation set reaches the preset accuracy threshold and remains stable for multiple consecutive rounds or reaches the preset number of rounds, stop training and obtain the current parameters as the initial curve feature extraction model parameters.
[0008] According to the above scheme, step S300 includes: S310, the discriminator is a multilayer perceptron neural network. The dimension of the discriminator input layer matches the dimension of the vector obtained by the outer product operation of the curve feature vector output by the encoder and the label prediction result output by the classifier. The output layer uses the Softmax activation function and outputs the binary classification probability of the input data source modeling device or target device. S320. Define the encoder and classifier in the preliminary curve feature extraction model as the generator in the adversarial training framework. S330: Fix the parameters of the generator, mix the labeled curve data of the modeling device with the unlabeled curve data of the target device and input them into the generator to obtain the corresponding curve feature vector and label prediction results, and construct the training dataset of the discriminator based on the outer product operation. S340. The discriminator is trained on the training dataset of the discriminator to minimize the error rate of device origin discrimination until the discriminator converges to the predetermined discrimination accuracy.
[0009] According to the above scheme, step S400 includes: S410. In each training iteration, a training batch is extracted from the labeled curve data of the modeling device and the unlabeled curve data of the target device according to a preset batch size, and input into the adversarial training framework; the training batch includes the labeled curve data of the modeling device and the unlabeled curve data of the target device. S420. Input the curve data of the two types of equipment into the encoder respectively, and extract the feature vector of the modeling equipment and the feature vector of the target equipment; input the feature vector of the modeling equipment into the classifier to obtain the label prediction result; S430. Input the outer product of the modeling device feature vector and its label prediction result, and the outer product of the target device feature vector and its label prediction result into the discriminator; use the binary classification cross-entropy as the loss function to optimize the discriminator; S440, jointly optimizes the encoder and classifier. The joint loss function is composed of the weighted sum of classification loss and adversarial loss. The classification loss is the cross-entropy between the predicted result of the modeling device curve and the true label. The adversarial loss is the negative logarithm of the probability that the discriminator classifies the target device curve feature as the modeling device. By minimizing the joint loss function, the generator can maintain classification accuracy and learn to extract device-invariant feature representations.
[0010] The joint loss function is expressed in the following formula: L E,C =L cls -λ×L adv ; Among them, L E,C L is represented as the joint optimization objective function of the encoder and classifier; cls Represented as classification loss, it is the cross-entropy loss between the predicted result of the modeling device curve and the true sensitive median label; L adv λ represents the adversarial loss, which drives the encoder to generate features that are invariant to the device; λ represents the adversarial loss weight, which is used to balance the relative importance of classification loss and adversarial loss in joint optimization.
[0011] According to the above scheme, step S500 includes: S510. During adversarial training, obtain the set of feature vectors extracted by the encoder from the modeling device curve and the target device curve, respectively, from the current training batch. S520, Analyze the distribution distance between the feature vector set of the modeling device and the feature vector set of the target device in the latent space. The latent space is the high-dimensional space where the curve feature vector output by the encoder is located. The dimension is the same as the dimension of the feature vector output by the encoder. The distribution distance is quantified by the maximum mean difference. The formula for distribution distance is as follows: ; Where MMD(P,T) represents the maximum mean difference distance between the modeling device feature distribution P and the target device feature distribution T; P represents the modeling device feature distribution; T represents the target device feature distribution; m represents the number of feature vectors sampled from the modeling device feature set; n represents the number of feature vectors sampled from the target device feature set; f p i Let f be the i-th feature vector sampled from the feature set of the modeling device; a jLet represent the j-th feature vector sampled from the feature set of the target device; i and j represent the feature vector indices of the feature set of the modeling device and the feature set of the target device, respectively; φ() represents a nonlinear mapping function that maps features to the reproducing kernel Hilbert space; H represents the reproducing kernel Hilbert space; S530. Record and analyze the numerical sequence of distribution distances over multiple consecutive training cycles, and analyze the sliding variance of the numerical sequence of distribution distances. S540. When the sliding variance of the distribution distance numerical sequence is continuously lower than the first preset threshold and the sliding average is continuously lower than the second preset threshold, it is determined that the feature distributions of the modeling device and the target device have tended to be stably overlapping. The first preset threshold is set to a positive decimal close to zero to determine whether the distribution distance has stopped oscillating; the second preset threshold is set to a value slightly higher than the baseline MMD value to determine whether the distribution distance is small enough. S550. When the distribution of the determined features has become stable and overlapping, the curve feature extraction model has converged, and the adversarial training process stops.
[0012] The maximum mean difference distance effectively measures the difference between two high-dimensional feature distributions. The smaller the value and the more stable it is, the closer the two distributions are, meaning that the features learned by the model are more device-invariant and the model has converged.
[0013] According to the above scheme, step S600 includes: S610: Collect multiple attack curve data generated by the target device when it performs encryption operations using an unknown key; S620. Input the data of a single attack curve into the curve feature extraction model, and output the predicted probability distribution of all possible sensitive intermediate value labels through the classifier. S630. Based on the predicted probability distribution and combined with the corresponding encrypted plaintext, analyze the cumulative likelihood score of all candidate keys. S640. Obtain the likelihood scores of all attack curve data and accumulate the likelihood scores of each candidate key; sort all candidate keys in descending order according to the accumulated likelihood scores, and take the candidate key ranked first as the correct key to be recovered.
[0014] A cross-device modeling side-channel attack monitoring system based on adversarial learning, comprising: a data acquisition module, a model pre-training module, an adversarial training module, a model evaluation module, and a key recovery module; The data acquisition module collects side-channel curve data from similar devices and performs device segmentation and labeling. The model pre-training module trains the curve feature extraction model using the labeled data from the modeling devices to obtain a preliminary curve feature extraction model. The adversarial training module constructs an adversarial training framework, optimizes the curve feature extraction model through a generator and discriminator, and learns device-invariant feature representations. The model evaluation module evaluates the convergence status of the curve feature extraction model in real time during adversarial training. The key recovery module analyzes the attack curves of the target device using the curve feature extraction model, calculates and sorts the key guessing score, and recovers the correct secret key.
[0015] According to the above scheme, the data acquisition module includes a signal acquisition module and a data labeling module; the signal acquisition module controls the set of devices and acquires the physical leakage signals generated during device operation, and converts the physical leakage signals into digital side channel curve data; the data labeling module distinguishes the modeling devices from the set of devices and targets the target devices, and labels the curve data of the modeling devices with sensitive intermediate value tags related to encryption operations.
[0016] According to the above scheme, the adversarial training module includes a framework initialization module and an iterative training module. The framework initialization module configures the discriminator network and defines the pre-trained model as the generator to build and initialize the adversarial training framework. The iterative training module performs the iterative optimization process of adversarial training, alternately updates the discriminator and generator parameters, and learns device-invariant feature representations.
[0017] Compared with the prior art, the beneficial effects of the present invention are: 1. This invention overcomes the problem of model performance degradation caused by device differences by introducing an adversarial learning mechanism to drive the model to actively learn device-invariant feature representations, thus enabling the model trained using a single modeling device to successfully attack different target devices. 2. This invention quantifies device feature distance based on the maximum mean difference of latent space feature distribution. By analyzing the sliding variance and sliding mean of the distance sequence over consecutive training periods, the convergence state of the model can be objectively determined without target device labels, thus ensuring the quality and stability of the model. 3. This invention predicts the probability distribution by using the sensitive intermediate value labels output by the classifier, calculates the likelihood score of candidate keys by combining the encrypted plaintext, and sorts the scores of multiple attack curves to select the correct key. This significantly reduces the interference of random noise on key recovery and improves the accuracy of key extraction and attack efficiency. Attached Figure Description
[0018] Figure 1 This is a flowchart illustrating the steps of the cross-device modeling side-channel attack monitoring method based on adversarial learning in this invention. Figure 2 This is a schematic diagram of the cross-device modeling side-channel attack monitoring system based on adversarial learning according to the present invention. Detailed Implementation
[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0020] Example: Figures 1-2 As shown, this invention provides a technical solution: a cross-device modeling side-channel attack monitoring method based on adversarial learning, which includes the following steps: S100: Collect side-channel curve data of similar devices running the same encryption algorithm, and divide the devices into modeling devices and target devices; label the curve data of the modeling devices with encryption operation sensitive intermediate value labels, while the curve data of the target devices remains unlabeled. Specifically, step S100 includes: S110. Set up a device set consisting of multiple encryption devices of the same model, with all devices in the device set running the same encryption algorithm; S120. Collect physical leakage signals while the encryption device is running and convert them into digital side-channel curve data; S130. Specify at least one device from the device set as the modeling device, and the remaining devices as the target devices; S140. During the encryption operation of the modeling device, record the sensitive intermediate values associated with the encryption key and plaintext, and label the Hamming weight or Hamming distance of the sensitive intermediate values onto the corresponding side channel curve data of the modeling device. S150. Collect the side channel curve data of the target device when running the encryption algorithm, and keep the side channel curve data of the target device when running the encryption algorithm in a tagless state.
[0021] S200. Using labeled curve data from the modeling equipment, pre-train the curve feature extraction model to obtain a preliminary curve feature extraction model; the curve feature extraction model includes an encoder and a classifier. Specifically, step S200 includes: S210, the curve feature extraction model includes an encoder and a classifier; the encoder adopts a convolutional neural network structure to extract features from the input side-channel curve data and outputs a fixed-dimensional curve feature vector; the classifier adopts a fully connected neural network structure, based on the curve feature vector, to predict the encryption operation sensitive intermediate value label of the side-channel curve data and output the label prediction result. For example: The encoder uses a three-layer one-dimensional convolutional neural network with 16, 32 and 64 convolutional kernels, and kernel sizes of 25, 3 and 3, respectively, and finally outputs a 128-dimensional curve feature vector; the classifier is a fully connected layer with 9 neurons connected to the Softmax activation function; this is just an example and is not a limitation. S220. Divide the labeled side-channel curve data of the modeling device into a training set and a validation set; S230. Supervised training of the curve feature extraction model is performed based on the training set. The output of the curve feature extraction model is analyzed by forward propagation, and the difference between the output and the true label is evaluated by using cross-entropy as the loss function. Before training, the labeled curve data of the modeling device is preprocessed. The preprocessing includes data normalization and temporal denoising. Data normalization maps the numerical range of all curve data to a preset interval to eliminate the magnitude difference between different curves. Temporal denoising uses a moving average filtering algorithm to filter out random noise introduced by the acquisition environment in the curve data to obtain a standardized labeled curve dataset. S240. Optimize the model parameters of the curve feature extraction model through the backpropagation algorithm, minimize the loss function, and monitor the performance of the curve feature extraction model on the validation set to prevent overfitting. S250. When the classification accuracy of the curve feature extraction model on the validation set reaches the preset accuracy threshold and remains stable for multiple consecutive rounds or reaches the preset number of rounds, stop training and obtain the current parameters as the initial curve feature extraction model parameters; for example, when the model's classification accuracy on the validation set reaches 85% and remains stable for 5 consecutive rounds or the total number of training rounds reaches 50 rounds, stop training; save the model parameters at this time as the initial curve feature extraction model.
[0022] S300. Construct an adversarial training framework, which includes a preliminary curve feature extraction model and a discriminator; use the labeled curve of the modeling device and the unlabeled curve of the target device as input for iterative training. Specifically, step S300 includes: S310, the discriminator is a multilayer perceptron neural network. The dimension of the discriminator input layer matches the dimension of the vector obtained by the outer product operation of the curve feature vector output by the encoder and the label prediction result output by the classifier. The output layer uses the Softmax activation function and outputs the binary classification probability of the input data source modeling device or target device. For example, the discriminator is a multilayer perceptron with an input layer dimension of 128 × 9 = 1152, where 128 is the feature vector dimension and 9 is the number of label categories. The hidden layer has 64 neurons, and the output layer has 2 neurons that use the Softmax activation function to output the binary classification probability of the input data originating from the modeling device or the target device. This is just an example and is not a limitation. S320. Define the encoder and classifier in the preliminary curve feature extraction model as the generator in the adversarial training framework. S330: Fix the parameters of the generator, mix the labeled curve data of the modeling device with the unlabeled curve data of the target device and input them into the generator to obtain the corresponding curve feature vector and label prediction results, and construct the training dataset of the discriminator based on the outer product operation. S340. The discriminator is trained on the training dataset of the discriminator to minimize the error rate of device origin discrimination until the discriminator converges to the predetermined discrimination accuracy.
[0023] S400. In each iteration, the encoder extracts feature vectors from the curves of the two types of devices; the discriminator determines the source of the device based on the feature vectors and the output of the classifier; the parameters of the encoder and classifier are jointly optimized to minimize the modeling device classification error, maximize the discriminator's discrimination error, and learn the device-invariant feature representation. Specifically, step S400 includes: S410. In each training iteration, a training batch is extracted from the labeled curve data of the modeling device and the unlabeled curve data of the target device according to a preset batch size, and input into the adversarial training framework; the training batch includes the labeled curve data of the modeling device and the unlabeled curve data of the target device. For example: In each training iteration, a batch of labeled curve data from the modeling device is drawn in batch size 50, and a batch of unlabeled curve data from the target device is drawn in batch size 50, and both are input into the adversarial training framework. S420. Input the curve data of the two types of equipment into the encoder respectively, and extract the feature vector of the modeling equipment and the feature vector of the target equipment; input the feature vector of the modeling equipment into the classifier to obtain the label prediction result; S430. Input the outer product of the modeling device feature vector and its label prediction result, and the outer product of the target device feature vector and its label prediction result into the discriminator; use the binary classification cross-entropy as the loss function to optimize the discriminator; S440, jointly optimizes the encoder and classifier. The joint loss function is composed of the weighted sum of classification loss and adversarial loss. The classification loss is the cross-entropy between the predicted result of the modeling device curve and the true label. The adversarial loss is the negative logarithm of the probability that the discriminator classifies the target device curve feature as the modeling device. By minimizing the joint loss function, the generator can maintain classification accuracy and learn to extract device-invariant feature representations.
[0024] The joint loss function is expressed in the following formula: L E,C =L cls -λ×L adv ; Among them, L E,C L is represented as the joint optimization objective function of the encoder and classifier; cls Represented as classification loss, it is the cross-entropy loss between the predicted result of the modeling device curve and the true sensitive median label; L adv λ represents the adversarial loss, which drives the encoder to generate features that are invariant to the device; λ represents the adversarial loss weight, which is used to balance the relative importance of classification loss and adversarial loss in joint optimization.
[0025] The relative distance or overlap of the features of the S500 real-time monitoring modeling device and the target device in the latent space; when the relative distance or overlap tends to stabilize and exceeds the preset threshold, the curve feature extraction model is determined to have converged. Specifically, step S500 includes: S510. During adversarial training, obtain the set of feature vectors extracted by the encoder from the modeling device curve and the target device curve, respectively, from the current training batch. S520, Analyze the distribution distance between the feature vector set of the modeling device and the feature vector set of the target device in the latent space. The latent space is the high-dimensional space where the curve feature vector output by the encoder is located. The dimension is the same as the dimension of the feature vector output by the encoder. The distribution distance is quantified by the maximum mean difference. The formula for distribution distance is as follows: ; Where MMD(P,T) represents the maximum mean difference distance between the modeling device feature distribution P and the target device feature distribution T; P represents the modeling device feature distribution; T represents the target device feature distribution; m represents the number of feature vectors sampled from the modeling device feature set; n represents the number of feature vectors sampled from the target device feature set; f pi Let f be the i-th feature vector sampled from the feature set of the modeling device; p j Let represent the j-th feature vector sampled from the feature set of the target device; i and j represent the feature vector indices of the feature set of the modeling device and the feature set of the target device, respectively; φ() represents a nonlinear mapping function that maps features to the reproducing kernel Hilbert space; H represents the reproducing kernel Hilbert space; The MMD distance effectively measures the difference between two high-dimensional feature distributions. The smaller the value and the more stable it is, the closer the two distributions are, meaning that the features learned by the model are more device-invariant and the model has converged. S530. Record and analyze the numerical sequence of distribution distances over multiple consecutive training cycles, and analyze the sliding variance of the numerical sequence of distribution distances. S540. When the sliding variance of the distribution distance numerical sequence is continuously lower than the first preset threshold and the sliding average is continuously lower than the second preset threshold, it is determined that the feature distributions of the modeling device and the target device have tended to be stably overlapping. The first preset threshold is set to a positive decimal close to zero to determine whether the distribution distance has stopped oscillating; the second preset threshold is set to a value slightly higher than the baseline MMD value to determine whether the distribution distance is small enough. S550. When the distribution of the determined features has become stable and overlapping, the curve feature extraction model has converged, and the adversarial training process stops.
[0026] S600 uses a curve feature extraction model to analyze the attack curve of the target device, outputs the analysis key guessing score through a classifier, and recovers the correct key.
[0027] Specifically, step S600 includes: S610: Collect multiple attack curve data generated by the target device when it performs encryption operations using an unknown key; S620. Input the data of a single attack curve into the curve feature extraction model, and output the predicted probability distribution of all possible sensitive intermediate value labels through the classifier. S630. Based on the predicted probability distribution and combined with the corresponding encrypted plaintext, analyze the cumulative likelihood score of all candidate keys. S640. Obtain the likelihood scores of all attack curve data and accumulate the likelihood scores of each candidate key; sort all candidate keys in descending order according to the accumulated likelihood scores, and take the candidate key ranked first as the correct key to be recovered.
[0028] This invention provides another technical solution: a cross-device modeling side-channel attack monitoring system based on adversarial learning. The system includes: a data acquisition module, a model pre-training module, an adversarial training module, a model evaluation module, and a key recovery module. The data acquisition module collects side-channel curve data from similar devices and performs device segmentation and labeling. The model pre-training module trains the curve feature extraction model using the labeled data from the modeling devices to obtain a preliminary curve feature extraction model. The adversarial training module constructs an adversarial training framework, optimizes the curve feature extraction model through a generator and discriminator, and learns device-invariant feature representations. The model evaluation module evaluates the convergence status of the curve feature extraction model in real time during adversarial training. The key recovery module analyzes the attack curves of the target device using the curve feature extraction model, calculates and sorts the key guessing score, and recovers the correct secret key.
[0029] Specifically, the data acquisition module includes a signal acquisition module and a data labeling module; the signal acquisition module controls the set of devices and acquires the physical leakage signals generated during device operation, converting the physical leakage signals into digital side-channel curve data; the data labeling module distinguishes between modeling devices and target devices from the set of devices, and labels the curve data of the modeling devices with sensitive intermediate value tags related to encryption operations.
[0030] Specifically, the adversarial training module includes a framework initialization module and an iterative training module. The framework initialization module configures the discriminator network and defines the pre-trained model as the generator, thus building and initializing the adversarial training framework. The iterative training module performs the iterative optimization process of adversarial training, alternately updating the discriminator and generator parameters, and learning device-invariant feature representations.
[0031] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.
Claims
1. An adversarial learning based cross-device modeling side-channel attack monitoring method, characterized in that: The method comprises: S100, collecting side channel curve data of similar devices running the same encryption algorithm, dividing the devices into modeling devices and target devices; labeling the curve data of the modeling devices with encryption operation sensitive intermediate value labels, and keeping the curve data of the target devices unlabeled; S200, pre-training a curve feature extraction model using the labeled curve data of the modeling devices, to obtain a preliminary curve feature extraction model; the curve feature extraction model comprises an encoder and a classifier; S300, constructing an adversarial training framework comprising the preliminary curve feature extraction model and a discriminator; iteratively training the labeled curve of the modeling devices and the unlabeled curve of the target devices as input; S400, in each iteration, the encoder extracts a feature vector from the curves of the two types of devices; the discriminator determines the device source based on the feature vector and the output of the classifier; the parameters of the encoder and the classifier are jointly optimized to minimize the classification error of the modeling devices and maximize the discrimination error of the discriminator to learn a feature representation invariant to the device; S500, real-time monitoring of the relative distance or overlap degree of the feature distribution of the modeling devices and the target devices in the hidden space; when the relative distance or overlap degree tends to be stable and exceeds a preset threshold, it is determined that the curve feature extraction model converges; S600, using the curve feature extraction model to analyze the attack curve of the target device, outputting an analysis key guess score through the classifier to recover the correct key. 2.The method of claim 1, wherein: Step S100 comprises: S110, setting a device set composed of a plurality of same type encryption devices, all devices in the device set running the same encryption algorithm; S120, collecting physical leakage signals when the encryption devices are running, and converting them into digitized side channel curve data; S130, specifying at least one device from the device set as a modeling device, and the remaining devices as target devices; S140, recording sensitive intermediate values associated with encryption keys and plaintexts during the encryption operation of the modeling device, and labeling the Hamming weight or Hamming distance of the sensitive intermediate values as labels on the corresponding side channel curve data of the modeling device; S150, collecting side channel curve data of the target devices when running the encryption algorithm, and keeping the side channel curve data of the target devices when running the encryption algorithm in an unlabeled state. 3.The method of claim 1, wherein: Step S200 comprises: S210, the curve feature extraction model comprises an encoder and a classifier; the encoder adopts a convolutional neural network structure for feature extraction of input side channel curve data, and outputs a curve feature vector of fixed dimension; the classifier adopts a fully connected neural network structure, and predicts the encryption operation sensitive intermediate value label of the side channel curve data based on the curve feature vector, and outputs a label prediction result; S220, dividing the labeled side channel curve data of the modeling devices into a training set and a validation set; S230, supervised training the curve feature extraction model based on the training set, forward propagation analysis the curve feature extraction model output, and cross-entropy as a loss function to evaluate the difference between the output and the true label; S240, the model parameters of the curve feature extraction model are optimized by the back propagation algorithm, the loss function is minimized, and the performance of the curve feature extraction model is monitored on the verification set to prevent overfitting; S250, when the classification accuracy of the curve feature extraction model on the verification set reaches the preset precision threshold and is stable for a plurality of rounds or reaches the preset round, the training is stopped, and the current parameters are obtained as the preliminary curve feature extraction model parameters.
4. The method of claim 1, wherein the method is characterized by: Step S300 includes: S310, the discriminator is a multi-layer perception neural network, the dimension of the input layer of the discriminator matches the vector dimension obtained by the outer product operation of the curve feature vector output by the encoder and the label prediction result output by the classifier, the output layer adopts a Softmax activation function, and the binary classification probability of the input data source modeling device or target device is output; S320, the encoder and the classifier in the preliminary curve feature extraction model are jointly defined as the generator in the adversarial training framework; S330, the parameters of the generator are fixed, the labeled curve data of the modeling device and the unlabeled curve data of the target device are mixed and input into the generator, the corresponding curve feature vector and label prediction result are obtained, and the training data set of the discriminator is constructed based on the outer product operation; S340, the discriminator is trained based on the training data set of the discriminator to minimize the error rate of device source discrimination until the discriminator converges to a predetermined discrimination accuracy.
5. The method of claim 1, wherein: Step S400 includes: S410, in each training iteration, a training batch is extracted from the labeled curve data of the modeling device and the unlabeled curve data of the target device according to a preset batch size and input into the adversarial training framework; the training batch includes the labeled curve data of the modeling device and the unlabeled curve data of the target device; S420, the curve data of the two types of devices is input into the encoder respectively to extract the feature vectors of the modeling device and the target device; the feature vector of the modeling device is input into the classifier to obtain the label prediction result; S430, the outer product of the feature vector of the modeling device and its label prediction result and the outer product of the feature vector of the target device and the label prediction result are jointly input into the discriminator; a binary classification cross-entropy is used as a loss function to optimize the discriminator; S440, the encoder and the classifier are jointly optimized, and the joint loss function is composed of a classification loss and an adversarial loss weighted sum; the classification loss is the cross-entropy of the prediction result of the modeling device curve and the true label; the adversarial loss is the negative logarithm of the probability that the discriminator discriminates the target device curve feature as the modeling device; by minimizing the joint loss function, the generator keeps the classification accuracy and learns to extract the device-invariant feature representation.
6. The method of claim 1, wherein the method further comprises: Step S500 includes: S510, in the adversarial training process, from the current training batch, the feature vector set extracted from the modeling device curve and the target device curve by the encoder is obtained respectively; S520, analyze the distribution distance of the modeling device feature vector set and the target device feature vector set in the hidden space, the hidden space is the high-dimensional space where the curve feature vector output by the encoder is located, the dimension is consistent with the dimension of the feature vector output by the encoder, and the distribution distance is quantified by maximum mean difference; S530, record and analyze the distribution distance value sequence of continuous multiple training periods, and analyze the sliding variance of the distribution distance value sequence; S540, when the sliding variance of the distribution distance value sequence is continuously lower than the first preset threshold, and the sliding average is continuously lower than the second preset threshold, it is determined that the feature distribution of the modeling device and the target device has tended to be stable overlap; S550, when it is determined that the feature distribution has tended to be stable overlap, the curve feature extraction model has converged, and the adversarial training process is stopped.
7. The method of claim 1, wherein the method further comprises: Step S600 includes: S610, collect a plurality of attack curve data generated by the target device when using unknown key for encryption operation; S620, input single attack curve data into the curve feature extraction model, and output the prediction probability distribution of all possible sensitive intermediate value labels through the classifier; S630, based on the prediction probability distribution, combined with the corresponding encryption plaintext, analyze the cumulative likelihood score of all candidate keys; S640, obtain the likelihood score of all attack curve data, accumulate the likelihood score of each candidate key; according to the cumulative likelihood score, arrange all candidate keys in descending order, and take the first ranked candidate key as the recovered correct key.
8. A cross-device modeling side-channel attack monitoring system based on adversarial learning, characterized in that: The system comprises: a data acquisition module, a model pre-training module, an adversarial training module, a model evaluation module and a key recovery module; The data acquisition module is used for collecting side channel curve data of the same type of device, and performing device division and label annotation; the model pre-training module is used for training the curve feature extraction model by using the labeled data of the modeling device, to obtain a preliminary curve feature extraction model; the adversarial training module is used for constructing an adversarial training framework, optimizing the curve feature extraction model through the generator and the discriminator, and learning the feature representation invariant to the device; the model evaluation module is used for evaluating the convergence state of the curve feature extraction model in real time during the adversarial training process; and the key recovery module is used for analyzing the attack curve of the target device by using the curve feature extraction model, and recovering the correct secret key by calculating and sorting the key guess score.
9. The cross-device modeling side channel attack monitoring system based on adversarial learning according to claim 8, characterized in that: The data collection module comprises a signal collection module and a data labeling module; the signal collection module controls the device set and collects the physical leakage signals generated when the device runs, and converts the physical leakage signals into digitized side channel curve data; the data labeling module divides the modeling device and the target device from the device set, and labels the sensitive intermediate value label related to the encryption operation for the curve data of the modeling device.
10. The cross-device modeling side channel attack monitoring system based on adversarial learning according to claim 8, characterized in that: The adversarial training module comprises a framework initialization module and an iterative training module; the framework initialization module configures the discriminator network, defines the pre-training model as the generator, and builds and initializes the adversarial training framework; the iterative training module performs the iterative optimization process of the adversarial training, alternately updates the parameters of the discriminator and the generator, and learns the device-invariant feature representation.