Side channel analysis method and system based on bit decoupling and medium

Abstract

The invention relates to the technical field of side channel analysis, and particularly provides a side channel analysis method and system based on bit decoupling and a medium, and the method comprises the steps: obtaining power consumption data during encryption, calculating an intermediate value, and carrying out the multi-label decoupling; extracting multi-scale features from the preprocessed energy traces, performing weighted fusion, and outputting global shared features; mapping the global shared features into initial bit features through linear projection, calculating a dependency relationship between the bit features by using an attention mechanism, and generating interactive bit features; the fusion proportion is dynamically adjusted through gating parameters, fusion features are input into a multi-label classifier, the posterior probability of each bit is obtained, and a loss function is adopted for training; and inputting a to-be-measured energy trace into the trained neural network model, outputting a prediction probability, and selecting a target key by calculating the confidence coefficient of the candidate key through traversal. According to the method, the quantity of required energy traces is greatly reduced, and meanwhile, the attack success rate in a low signal-to-noise ratio environment is remarkably improved.

Description

Technical Field

[0001] This invention belongs to the field of side-channel analysis technology, and particularly relates to a side-channel analysis method, system and medium based on bit decoupling. Background Technology

[0002] With the widespread application of IoT technology, numerous embedded devices, such as smart meters, industrial controllers, and vehicle gateways, are deployed in open and uncontrolled physical environments. These devices typically rely on standard cryptographic algorithms to ensure data confidentiality and integrity. However, the physical security and mathematical security of a cryptographic algorithm are not equivalent. Side-channel analysis (SCA), a highly threatening physical attack method, analyzes unexpected physical information leaked during encryption operations, such as power consumption, electromagnetic radiation, and execution time. By leveraging the statistical correlation between this information and internal sensitive data (such as keys and intermediate values), it is possible to directly recover the key without compromising the algorithm's mathematical structure.

[0003] Traditional side-channel analysis methods, such as Simple Power Analysis (SPA), Differential Power Analysis (DPA), and Correlation Power Analysis (CPA), are all based on the assumption that device power consumption and the Hamming weight of processed data are linearly related. They infer the key by calculating the correlation coefficient between the assumed power consumption and the actual measured trace. However, these methods have limitations in practical applications: they are highly dependent on waveform alignment and extremely sensitive to noise, clock jitter, and desynchronization mechanisms. Furthermore, their linear leakage assumption makes them ineffective against advanced protection measures such as masking and out-of-order execution. In particular, masking techniques force attackers to use higher-order analysis by randomizing intermediate values, leading to an exponential increase in the required sample size.

[0004] In recent years, Deep Learning-based Side-Channel Analysis (DL-SCA) has leveraged the powerful nonlinear feature extraction capabilities of deep neural networks to directly learn leakage patterns from raw, noisy, or unaligned energy traces, outperforming traditional template attacks. However, existing DL-SCA methods still face several technical bottlenecks: First, the single-byte 256 classification model suffers from the curse of dimensionality, resulting in a large output space and sparse samples, which easily leads to overfitting or convergence difficulties. Second, while the Hamming weight model, used to reduce classification dimensionality, simplifies the task, it loses bit-level fine-grained information, reducing key discrimination efficiency. Third, the independent bit model assumes that each bit leakage is independent, ignoring the nonlinear algebraic dependencies between bits in cryptographic algorithms (such as S-box outputs), making it impossible for strong leaked bits to assist in the inference of weak leaked bits, thus limiting the upper limit of model performance. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention provides a side-channel analysis method based on bit decoupling, comprising the following steps: Step S1: Obtain the power consumption data of the reference device during encryption as an energy trace, and at the same time obtain the corresponding plaintext and key. Calculate the intermediate value based on the plaintext and key, and perform multi-label decoupling on the intermediate value to generate a binary bit vector. Step S2: Input the preprocessed energy trace into the adaptive feature extraction network to extract multi-scale features, and perform weighted fusion of the multi-scale features to output a globally shared feature containing time-domain information and frequency-domain energy. Step S3: Map the global shared features to initial bit features through linear projection, calculate the dependencies between the initial bit features using an attention mechanism, and generate interactive bit features with fused algebraic dependencies based on the dependencies. Step S4: Introduce a gated residual connection mechanism, dynamically adjust the fusion ratio of the initial bit features and interactive bit features through the gate parameters, output the fused features, input the fused features into a multi-label classifier to obtain the posterior probability of each bit, and use a loss function for training. Step S5: Input the energy trace of the target device to be tested into the trained neural network model, output the predicted probability, calculate the confidence of the candidate key by combining the log-likelihood scorer, and select the target key based on the confidence.

[0006] Preferably, in step S1, multi-label decoupling of intermediate values ​​is performed specifically as follows: Construct a mapping function to assign decimal labels to intermediate values. Mapped to an 8-dimensional binary vector ,in, Indicates the middle value of the first The state of each bit.

[0007] Based on the above scheme, step S2 specifically includes: S21: The input features are processed through two convolutional branches of different scales to obtain feature maps of the micro-branch and the macro-branch; S22: The feature maps of the micro-branch and macro-branch are fused to obtain the branch fusion feature. Global average pooling is performed on the branch fusion feature to generate channel statistical vectors. The channel statistical vectors are then mapped to global descriptors through a fully connected layer. S23: The global descriptor is projected to the original channel dimension using two independent fully connected layers, and then normalized by the softmax function to generate attention weight vectors for the micro-branch and macro-branch respectively. Based on the attention weight vectors, the feature maps of the micro-branch and macro-branch are weighted and fused to generate adaptive features. S24: After flattening the adaptive feature map output by the multi-layer selective kernel convolution block, it is compressed and fused with high-dimensional semantic features through a fully connected layer to output globally shared features.

[0008] Based on the above scheme, step S3 specifically includes: S31: The globally shared features are mapped to eight initial bit features with specific physical identities using a linear projector; S32: Using a multi-head attention mechanism, the initial bit features are mapped to a query matrix, a key matrix, and a value matrix, and the attention score matrix is ​​calculated based on the query matrix and the key matrix; S33: Based on the attention score matrix, the value matrix is ​​weighted and aggregated to generate interactive bit features containing context-dependent information.

[0009] Preferably, the loss function in step S4 is a weighted binary cross-entropy loss: , Where N is the number of training samples, Let j be the weight coefficient of the j-th bit. For the true label of the j-th bit of the n-th sample, Let be the predicted probability of the j-th bit predicted by the model.

[0010] Based on the above scheme, the method for selecting the target key in step S5 is as follows: S51: For each candidate key and energy trace, calculate its median value and binary bit vector; S52: Based on the energy trace, obtain the predicted probability obtained by the neural network model, calculate the total confidence score of the candidate key, and iterate through and select the candidate key with the highest score as the target key.

[0011] Based on the above scheme, the attention score matrix is ​​as follows: ; Where Q is the query matrix and K is the key matrix. This specifies the dimensions of the query vector and key vector.

[0012] Based on the above scheme, the fusion feature in step S4 is as follows: ; in, For initial bit features, For interactive bit features, The gating parameter is initialized to 0.

[0013] On the other hand, the present invention provides a side-channel analysis system based on bit decoupling, comprising: The data acquisition and processing module is used to acquire the power consumption data of the reference device during encryption as an energy trace, and at the same time acquire the corresponding plaintext and key, calculate the intermediate value based on the plaintext and key, perform multi-label decoupling on the intermediate value, and generate a binary bit vector. The adaptive feature extraction module is used to input the preprocessed energy trace into the adaptive feature extraction network, extract multi-scale features, and perform weighted fusion of multi-scale features to output globally shared features containing time-domain information and frequency-domain energy. The bit-dependent interaction module is used to map the globally shared features to initial bit features through linear projection, calculate the dependencies between the initial bit features using an attention mechanism, and generate interactive bit features with fused algebraic dependencies based on the dependencies. The gating adjustment and multi-label classification module is used to introduce a gating residual connection mechanism. It dynamically adjusts the fusion ratio of the initial bit features and the interactive bit features through the gating parameters, outputs the fused features, inputs the fused features into the multi-label classifier, obtains the posterior probability of each bit, and uses a loss function for training. The key recovery module is used to input the energy trace of the target device into the trained neural network model, output the predicted probability, calculate the confidence of the candidate key by combining the log-likelihood scorer, and select the target key based on the confidence.

[0014] The present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the bit-decoupling-based side-channel analysis method described above.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. The 256-class classification task is transformed into 8 bit-level binary classification tasks, which greatly reduces the number of model parameters and the number of samples required for training. This significantly reduces the number of energy traces required to recover the key, thereby significantly reducing the attack time and storage costs. 2. An adaptive feature extraction network dynamically adjusts the receptive field through a split-fusion-selection mechanism. When the power trace expands or shifts in time, the network can automatically increase the weights of macroscopic branches to cover the feature region. On datasets with severe clock jitter, this invention can still maintain a very high attack success rate compared to fixed convolutional kernel models. 3. By explicitly modeling the dependencies between bit features using the attention mechanism, mutual information that was fragmented by independent models was successfully retrieved. It can use strong leaked bits with high signal-to-noise ratio to assist in predicting weak leaked bits that are submerged by noise, which significantly improves the key recovery capability in low signal-to-noise ratio environments. 4. The multi-label binary classification task gradient used in this invention is smoother, and due to the introduction of gated residual connections, the model adopts a learning strategy of first independent and then interactive, which effectively alleviates the cold start oscillation problem, enabling the model to fit quickly even with few samples, and making the model training more stable and easier to converge. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the overall side-channel analysis process of the present invention. Figure 2 This is a schematic diagram of multi-tag decoupling provided by the present invention; Figure 3 This is a flowchart illustrating the adaptive feature extraction implementation of the present invention. Figure 4 This is a flowchart illustrating the bit-dependent interaction implementation of the present invention. Detailed Implementation

[0017] The invention will be further described below with reference to specific embodiments.

[0018] Example 1 like Figure 1 As shown, this invention provides a side-channel analysis method based on bit decoupling, comprising the following steps: Step S1: Using a controllable reference device with a hardware architecture completely identical to the target cryptographic device, perform encryption operations on the reference device with known plaintext and known key, collect the power consumption trace during the encryption process as the power trace, and record the corresponding plaintext and key data; calculate the intermediate value of the cryptographic algorithm based on the known plaintext and key, and decouple the intermediate value with multiple labels, converting the single-byte decimal label into a multi-dimensional binary bit vector; In this embodiment, during the modeling phase, a controllable reference device is used to collect N energy traces and record the corresponding plaintext. and key The intermediate value is calculated using a cryptographic algorithm: Since the key of the reference device is fully controllable, the intermediate true label corresponding to each energy trace can be accurately calculated for supervised training. In the subsequent attack phase (step S5), for target devices with unknown keys, only the plaintext and energy trace need to be obtained. The intermediate value is calculated by traversing candidate key hypotheses, and the trained model is used to recover the key.

[0019] The traditional single-byte model will As a scalar category label One-Hot encoding is used for 256 classifications, but this method ignores the Hamming distance relationship between label values ​​and results in extremely sparse categories. Therefore, step S1 of this embodiment decouples intermediate values ​​from multiple labels, such as... Figure 2 As shown, specifically: Define mapping function The decimal label of the middle value Mapped to an 8-dimensional binary vector ,in, Indicates the middle value of the first The state of each bit.

[0020] This step assumes that the leakage of each bit follows an independent Bernoulli distribution, providing a basis for constructing the objective function for multi-label learning. It breaks the mutual exclusion constraint of traditional Softmax, reducing the complexity of the model parameters from exponential to linear. Reduced to linear level .

[0021] By decoupling the multi-labels as described above, the original single-task multi-class classification problem is transformed into a multi-task binary classification problem. Each output node is only responsible for predicting whether the j-th bit is 0 or 1. This makes the proportion of 0 and 1 in the sample distribution of each task statistically balanced (approximately 50%:50%), completely solving the problems of long-tail distribution and insufficient samples in 256 classification.

[0022] Step S2: First, the power consumption data in step S1 is preprocessed. The preprocessing includes: time alignment based on the trigger signal to eliminate random offset of the acquisition start point; and z-score standardization of the energy trace, i.e., subtracting the mean and dividing by the standard deviation, to eliminate DC offset and amplitude differences between different acquisition batches.

[0023] The preprocessed energy trace is then input into an adaptive feature extraction network to extract multi-scale features. The multi-scale features are then weighted and fused to output a globally shared feature that includes time-domain information and frequency-domain energy.

[0024] In this embodiment, as Figure 3 As shown, step S2 specifically includes: S21: Input the preprocessed one-dimensional energy trace into the first layer of selective kernel convolutional block. Through multi-scale convolutional branches, the original single-channel time series is mapped to a multi-channel feature map. The given feature map... It goes through two convolutional branches of different scales. , To process, , They each have different kernel sizes. and This yields the feature maps of the micro and macro branches.

[0025] Specifically, micro-branching use Convolution kernel, dilation rate This branch has a small receptive field and focuses on capturing the high-frequency detail features generated during a single-bit flip, outputting... Macroeconomic Branch use Convolution kernel, dilation rate This branch senses the large field and focuses on capturing low-frequency contours and contextual information within the instruction execution cycle, outputting... .

[0026] In other embodiments, macro branches may also employ The convolution kernel processes the feature map to obtain the feature map of the macro branch; step S21 can also use group convolution to increase the size of the convolution kernel (receptive field) while controlling the number of parameters and computation, so as to prevent the model from overfitting or training too slowly.

[0027] S22: Summing the feature maps of micro-branches and macro-branches element by element to obtain the branch fusion feature. Global average pooling is performed on the branch fusion features to generate channel statistical vectors. : , Branch fusion feature on channel c; Then, the channel statistics vector s is mapped to a global descriptor z through a fully connected layer: , The frequency domain energy distribution of the current input signal is encoded, where, It is the ReLU activation function. It is a batch of normalization, Compression ratio It is usually set to 16, that is C is the number of channels, d min It is the minimum dimension, usually 32.

[0028] S23: The global descriptor z is projected onto the original channel dimension using two independent fully connected layers, and then normalized using the softmax function to generate attention weight vectors a for the micro-branch and b for the macro-branch, respectively. ,in, It is a weight matrix. and These are the micro-branch and macro-branch in the channel. The soft attention weights on the surface satisfy .

[0029] Adaptive features are generated by weighted fusion of feature maps from micro and macro branches based on attention weight vectors. ,in, This represents the feature of the c-th channel in the feature map output by the micro-branch. This is the feature of the c-th channel in the feature map output by the macro branch. This represents the adaptive feature of the c-th channel after weighted fusion.

[0030] Steps S21 to S23 above constitute a selective kernel convolution block. The present invention stacks this convolution block into a multi-layer deep network, with the number of channels in each layer gradually increasing from 64 to 512. Each layer is followed by an average pooling layer with a stride of 2 to gradually reduce the temporal resolution and expand the effective receptive field.

[0031] S24: After multiple layers of adaptive filtering, the feature map is flattened and fed into a fully connected layer for compression and fusion of high-dimensional semantic features, and finally outputs globally shared features.

[0032] When the side channel signal experiences clock jitter, the signal waveform is stretched or compressed on the time axis. Selective kernel convolution can automatically increase the weight of the macroscopic branch according to this change in the signal, and use a larger receptive field to cover the jitter range, thus achieving robust feature extraction without the need for complex preprocessing alignment algorithms.

[0033] After extraction by the selective kernel convolution unit in step S2, a globally shared feature vector is obtained. The traditional independent bit model directly... The data was fed into eight fully connected layers for classification, ignoring the relationships between bits. This invention introduces a bit dependency relationship based on self-attention, specifically: Step S3: Map the globally shared features to initial bit features through linear projection, calculate the dependencies between the initial bit features using an attention mechanism, and generate interactive bit features with fused algebraic dependencies based on the dependencies. In this embodiment, as Figure 4As shown, step S3 specifically includes: S31: First, due to different chip layouts, the power leakage intensity of each bit varies. Therefore, shared features need to be converted into bit features to simulate the differences in driving capability between different bits in the hardware circuit: Define 8 learnable projection matrices. For the first bits, its initial feature vector The calculation is as follows: ; Where, bias is the independent bias vector of the j-th projector, used to encode different initial offsets for each bit, and step S31 assigns each bit an independent specific physical identity feature. S32: Using a multi-head attention mechanism, the eight initial feature vectors are stacked into a matrix and mapped to the query, key, and value subspaces respectively, resulting in the query matrix Q, key matrix K, and value matrix V. , , ; Calculate the attention score matrix based on the query matrix and the key matrix: ; Where, the matrix elements in A Let Q represent the dependency of the i-th bit on the j-th bit, and K be the query matrix and key matrix. The query matrix consists of query vectors, and the key matrix consists of key vectors. The dimensions of the query vector and key vector are used to scale the dot product to prevent the gradient from vanishing due to excessively large values.

[0034] Those skilled in the art should know that in an AES S-box, the output bit is a nonlinear function of the input; if the first bit... The leakage of the first bit is overwhelmed by noise (low signal-to-noise ratio), making it difficult for the model to predict directly; however, if the leakage of the second bit is... The single-bit leakage is strong, and the output bits and input bits are strongly correlated algebraically. The attention mechanism will automatically learn larger... Thus, the information of the j-th bit is used to correct the j-th bit. Features of 1 bit.

[0035] S33: Based on the attention score matrix A, perform weighted aggregation on the value matrix V to generate interactive bit features containing context-dependent information: .

[0036] Furthermore, to ensure the stability of training, this invention designs a gating mechanism, specifically as follows: Step S4: Introduce a gated residual connection mechanism, dynamically adjust the fusion ratio of the initial bit features and the interactive bit features through the gating parameters, and output the fused features: ,in, For initial bit features, For interactive bit features, These are the gating parameters initialized to 0. In the early stages of training, the model degenerates into an independent bit model, prioritizing the learning of easily learned physical leakage features; as independent feature learning reaches a bottleneck, gradient descent takes over. As it increases, the model begins to utilize... Collaborative inference is performed based on dependency information.

[0037] The fused features are input into a multi-label classifier, which consists of eight parallel output heads. Each output head uses a sigmoid activation function to output the posterior probability with the corresponding bit set to 1. End-to-end training is performed using a loss function, gradients are calculated using the backpropagation algorithm, and the parameters of the entire neural network, including the feature extraction network, bit-dependent interaction module, gating parameters, and the weights of the multi-label classifier, are updated using an optimizer.

[0038] According to this embodiment, the loss function adopts a weighted binary cross-entropy loss: , Where N is the number of training samples, Let j be the weight coefficient of the j-th bit. For the true label of the j-th bit of the n-th sample, This represents the predicted probability of the j-th bit by the model. Weights The difficulty of the bit can be dynamically adjusted to enhance training on weakly leaked bits.

[0039] This embodiment uses the Adam optimizer with an initial learning rate of 10. -3 In addition, a CosineAnnealing learning rate decay strategy is used to ensure that the model converges to the global optimum.

[0040] Step S5: During the attack phase, for the target cryptographic device with an unknown key, collect the energy trace and corresponding plaintext data of the device during encryption, input the energy trace to be tested into the trained neural network model, output the predicted probability of each bit, combine the log-likelihood scorer to traverse all candidate keys to calculate the confidence level, and select the target key based on the confidence level.

[0041] Specifically, the method for selecting the target key is as follows: S51: For each candidate key and attack focus Energy trace, calculate the median value under this guess. Decompose the intermediate value into 8 bits. ; S52: Input the energy trace into the neural network model to obtain the predicted probability. Calculate the total confidence score of the candidate key: ; Iterate through all 256 candidate keys and select the candidate key with the highest total confidence score as the target key for recovery.

[0042] This embodiment can be used for security evaluation of the AES-128 encryption algorithm on target embedded devices (such as STM32F4, AVRXMEGA). A high-precision oscilloscope is used to acquire the power consumption curve of the target embedded device during AES-128 encryption. The sampling rate is set to more than 10 times the system clock frequency to capture high-frequency leakage. The device I / O toggle signal is used as the trigger source to ensure that the starting point of each acquisition is approximately the same. energy trace And record the corresponding plaintext. and key The collected energy traces are divided into training set and Two attack sets were used for model training and key recovery testing, respectively.

[0043] Example 2 Based on the same inventive concept, this invention provides a side-channel analysis system based on bit decoupling, comprising: The data acquisition and processing module is used to acquire the power consumption data of the reference device during encryption as an energy trace, and at the same time acquire the corresponding plaintext and key, calculate the intermediate value based on the plaintext and key, perform multi-label decoupling on the intermediate value, and generate a binary bit vector. The adaptive feature extraction module, built on selective kernel convolution, is used to input the preprocessed energy trace into the adaptive feature extraction network, extract multi-scale features, and perform weighted fusion of multi-scale features to output globally shared features containing temporal information and frequency domain energy. The bit-dependent interaction module is used to map the globally shared features to initial bit features through linear projection, calculate the dependencies between the initial bit features using an attention mechanism, and generate interactive bit features with fused algebraic dependencies based on the dependencies. The gating adjustment and multi-label classification module is used to introduce a gating residual connection mechanism. It dynamically adjusts the fusion ratio of the initial bit features and the interactive bit features through the gating parameters, outputs the fused features, inputs the fused features into the multi-label classifier, obtains the posterior probability of each bit, and uses a loss function for training. The key recovery module is used to input the energy trace of the target device into the trained neural network model, output the predicted probability, calculate the confidence of the candidate key by combining the log-likelihood scorer, and select the target key based on the confidence.

[0044] For a detailed implementation of this embodiment, please refer to Embodiment 1, which will not be repeated here.

[0045] According to this invention, firstly, a multi-label decoupling strategy creatively transforms the complex single-byte 256 classification task into a low-dimensional bit-level binary classification task, fundamentally reducing the model's dependence on training data and significantly improving data utilization efficiency. Secondly, an adaptive feature extraction mechanism based on selective kernel convolutional units is introduced, utilizing the dynamic receptive field to automatically adapt to the frequency characteristics and temporal jitter of the signal, maintaining high attack performance in asynchronous environments without complex preprocessing. More importantly, this invention breaks through the limitations of traditional independent bit models, explicitly reconstructing the nonlinear algebraic dependencies between bits using a self-attention mechanism, enabling the model to possess collaborative inference capabilities and automatically correct prediction biases of weakly leaked bits using strong leakage information. Furthermore, a course learning strategy implemented with gated residual connections further ensures the model's training stability and convergence speed in complex scenarios. Combined with a supporting device resource management architecture, this invention provides an efficient, automated, and robust physical security assessment method for smart cards, IoT terminals, and embedded encryption modules, which has significant application value for improving the hardware security protection level of critical information infrastructure.

[0046] Furthermore, the bit-decoupling-based side-channel analysis method according to the present invention can be recorded in a computer-readable recording medium. Specifically, according to the present invention, a computer-readable recording medium storing computer-executable instructions can be provided, which, when executed by a processor, cause the processor to perform the bit-decoupling-based side-channel analysis method as described above.

[0047] It should be noted that the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or portion of code containing at least one executable instruction for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0048] In general, various exemplary embodiments of the present invention can be implemented in hardware or dedicated circuitry, software, firmware, logic, or any combination thereof. Some aspects can be implemented in hardware, while others can be implemented in firmware or software that can be executed by a controller, microprocessor, or other computing device. When aspects of embodiments of the present invention are illustrated or described as block diagrams, flowcharts, or represented using certain other images, it will be understood that the blocks, apparatuses, systems, techniques, or methods described herein can be implemented as non-limiting examples in hardware, software, firmware, dedicated circuitry or logic, general-purpose hardware or controllers or other computing devices, or certain combinations thereof.

[0049] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0050] While the specific embodiments of the present invention have been described above, they are not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A side-channel analysis method based on bit decoupling, characterized in that, Includes the following steps: Step S1: Obtain the power consumption data of the reference device during encryption as an energy trace, and at the same time obtain the corresponding plaintext and key. Calculate the intermediate value based on the plaintext and key, and perform multi-label decoupling on the intermediate value to generate a binary bit vector. Step S2: Input the preprocessed energy trace into the adaptive feature extraction network to extract multi-scale features, and perform weighted fusion of the multi-scale features to output a globally shared feature containing time-domain information and frequency-domain energy. Step S3: Map the global shared features to initial bit features through linear projection, calculate the dependencies between the initial bit features using an attention mechanism, and generate interactive bit features with fused algebraic dependencies based on the dependencies. Step S4: Introduce a gated residual connection mechanism, dynamically adjust the fusion ratio of the initial bit features and interactive bit features through the gate parameters, output the fused features, input the fused features into a multi-label classifier to obtain the posterior probability of each bit, and use a loss function for training. Step S5: Input the energy trace of the target device to be tested into the trained neural network model, output the predicted probability, calculate the confidence of the candidate key by combining the log-likelihood scorer, and select the target key based on the confidence.

2. The side-channel analysis method based on bit decoupling according to claim 1, characterized in that, In step S1, the intermediate values ​​are decoupled from their labels using multiple tags, specifically as follows: Construct a mapping function to assign decimal labels to intermediate values. Mapped to an 8-dimensional binary vector ,in, Indicates the middle value of the first The state of each bit.

3. The side-channel analysis method based on bit decoupling according to claim 1, characterized in that, Step S2 specifically includes: S21: The input features are processed through two convolutional branches of different scales to obtain feature maps of the micro-branch and the macro-branch; S22: The feature maps of the micro-branch and macro-branch are fused to obtain the branch fusion feature. Global average pooling is performed on the branch fusion feature to generate channel statistical vectors. The channel statistical vectors are then mapped to global descriptors through a fully connected layer. S23: The global descriptor is projected to the original channel dimension using two independent fully connected layers, and then normalized by the softmax function to generate attention weight vectors for the micro-branch and macro-branch respectively. Based on the attention weight vectors, the feature maps of the micro-branch and macro-branch are weighted and fused to generate adaptive features. S24: After flattening the adaptive feature map output by the multi-layer selective kernel convolution block, it is compressed and fused with high-dimensional semantic features through a fully connected layer to output globally shared features.

4. The side-channel analysis method based on bit decoupling according to claim 1, characterized in that, Step S3 specifically includes: S31: The globally shared features are mapped into eight initial bit features with specific physical identities using a linear projector; S32: Using a multi-head attention mechanism, the initial bit features are mapped to a query matrix, a key matrix, and a value matrix, and the attention score matrix is ​​calculated based on the query matrix and the key matrix; S33: Based on the attention score matrix, the value matrix is ​​weighted and aggregated to generate interactive bit features containing context-dependent information.

5. The side-channel analysis method based on bit decoupling according to claim 1, characterized in that, The loss function in step S4 is a weighted binary cross-entropy loss: ， Where N is the number of training samples, Let j be the weight coefficient of the j-th bit. For the true label of the j-th bit of the n-th sample, Let be the predicted probability of the j-th bit predicted by the model.

6. The side-channel analysis method based on bit decoupling according to claim 5, characterized in that, The method for selecting the target key in step S5 is as follows: S51: For each candidate key and energy trace, calculate its median value and binary bit vector; S52: Based on the energy trace, obtain the predicted probability obtained by the neural network model, calculate the total confidence score of the candidate key, and iterate through and select the candidate key with the highest score as the target key.

7. The side-channel analysis method based on bit decoupling according to claim 4, characterized in that, The attention score matrix is ​​as follows: ； Where Q is the query matrix and K is the key matrix. This specifies the dimensions of the query vector and key vector.

8. The side-channel analysis method based on bit decoupling according to claim 1, characterized in that, The fusion features in step S4 for: ； in, For initial bit features, For interactive bit features, The gating parameter is initialized to 0.

9. A side-channel analysis system based on bit decoupling, characterized in that, include: The data acquisition and processing module is used to acquire the power consumption data of the reference device during encryption as an energy trace, and at the same time acquire the corresponding plaintext and key, calculate the intermediate value based on the plaintext and key, perform multi-label decoupling on the intermediate value, and generate a binary bit vector. The adaptive feature extraction module is used to input the preprocessed energy trace into the adaptive feature extraction network, extract multi-scale features, and perform weighted fusion of multi-scale features to output globally shared features containing time-domain information and frequency-domain energy. The bit-dependent interaction module is used to map the globally shared features to initial bit features through linear projection, calculate the dependencies between the initial bit features using an attention mechanism, and generate interactive bit features with fused algebraic dependencies based on the dependencies. The gating adjustment and multi-label classification module is used to introduce a gating residual connection mechanism. It dynamically adjusts the fusion ratio of the initial bit features and the interactive bit features through the gating parameters, outputs the fused features, inputs the fused features into the multi-label classifier, obtains the posterior probability of each bit, and uses a loss function for training. The key recovery module is used to input the energy trace of the target device into the trained neural network model, output the predicted probability, calculate the confidence of the candidate key by combining the log-likelihood scorer, and select the target key based on the confidence.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the bit-decoupling-based side-channel analysis method as described in any one of claims 1-8.

Images