Method, device and medium for evaluating security of number theory transform module based on bypass analysis
By constructing a compact number-theory transformation factor graph and combining bypass information from early layers and subsequent polynomial multiplications, the problems of high complexity and poor noise adaptability in the security assessment of number-theory transformation modules in the prior art are solved, and efficient and stable security assessment is achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- ZHEJIANG UNIV
- Filing Date
- 2026-05-22
- Publication Date
- 2026-06-19
Smart Images
Figure CN122247594A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information security technology, and in particular to a method, device, and medium for security assessment of number theory transformation modules based on bypass analysis. Background Technology
[0002] With the rapid development of quantum computing technology, traditional public-key cryptography faces severe security challenges, and post-quantum cryptography (PQC) has become a key direction for ensuring information security. In lattice-based PQC algorithm implementations, number-theoretic transforms (NTTs), as the core computational module for accelerating polynomial multiplication, are widely used in key operations such as key generation, encryption / decryption, and digital signatures. Because NTTs directly process sensitive data related to the key during execution, their security directly affects the strength of the entire cryptographic system.
[0003] Currently, security assessment of number-theory transformation modules primarily employs side-channel analysis. Existing solutions typically construct a number-theory transformation factor graph by collecting side-channel information such as power consumption and electromagnetic radiation during device operation, and then attempt to recover the key using probabilistic inference methods such as belief propagation (BP), thereby measuring the leakage risk and security level of the target module. However, existing security assessment schemes still have the following significant drawbacks in practical applications:
[0004] 1. Existing schemes construct number-theoretic transformation factor graphs containing a large number of variable nodes and factor nodes. During belief propagation, message passing between nodes involves massive computational and storage overhead, resulting in long evaluation times, high resource consumption, and difficulty in achieving efficient batch evaluation.
[0005] 2. Existing factor graph inference frameworks typically rely heavily on bypass information generated from the input positions of early layers (such as the first and second layers) of number-theoretic transformations. However, in actual hardware devices, the leakage signals from early layers are often weak and susceptible to environmental noise, circuit interference, and other factors, leading to inaccurate probability distributions. Once the bypass evidence from early layers becomes invalid, the accuracy and stability of the entire evaluation process will significantly decrease.
[0006] 3. Existing solutions primarily focus on the bypass information generated by the number-theoretical transformation process itself, failing to fully explore the algebraic characteristics exhibited by the output of the number-theoretical transformation in subsequent operations (such as polynomial multiplication). In actual algorithm implementation, the coefficients of the number-theoretical transformation domain are often repeatedly accessed in the subsequent polynomial multiplication kernel and participate in operations with specific algebraic constraints. This evidence, containing multiple observations and algebraic constraint relationships, has long been ignored in existing evaluation frameworks, making it difficult for the evaluation results to achieve optimal convergence.
[0007] In summary, there is an urgent need for a security assessment method for number theory transformation modules that can reduce inference complexity, improve noise adaptability, and fully integrate subsequent computational constraint information, so as to achieve a more comprehensive and practical assessment of the security of post-quantum cryptography implementations. Summary of the Invention
[0008] To address the shortcomings of existing technologies, embodiments of the present invention provide a method, device, and medium for security assessment of number theory transformation modules based on bypass analysis.
[0009] In a first aspect, embodiments of the present invention provide a method for security assessment of number theory transformation modules based on bypass analysis, the method comprising:
[0010] Several first bypass curves generated by the target device during the execution of number theory transformation, and several second bypass curves generated during the polynomial multiplication process in which the output of the number theory transformation directly participates; a leakage template is constructed based on the first and second bypass curves;
[0011] Obtain the nodes and their connections corresponding to the butterfly operations at levels i to L in number-theoretical transformation, and construct a number-theoretical transformation factor graph;
[0012] Based on the leakage template, feature matching is performed on the first bypass curve and the second bypass curve respectively to obtain the first probability distribution and the second probability distribution;
[0013] The first probability distribution and the second probability distribution are fused together, and the resulting fused probability distribution is used as a priori condition to iteratively update the number theory transformation factor graph.
[0014] Based on the pre-constructed lookup table corresponding to the i-th layer butterfly operation, the node values of the i-th layer butterfly operation are obtained according to the updated number theory transformation factor graph. The node values are input into the lookup table to reverse the node values of the (i-1)-th layer butterfly operation, and so on, layer by layer, to reverse the input of the first layer butterfly operation, thereby recovering the key.
[0015] The security of the number theory transformation module is evaluated based on the recovered key.
[0016] In a second aspect, embodiments of the present invention provide an electronic device, comprising:
[0017] At least one processor; and
[0018] A memory communicatively connected to the at least one processor; wherein,
[0019] The memory stores one or more computer programs that can be executed by the at least one processor, and the one or more computer programs are executed by the at least one processor to enable the at least one processor to perform the above-described security assessment method for number theory transformation modules based on bypass analysis.
[0020] Thirdly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the above-described method for security assessment of number theory transformation modules based on bypass analysis.
[0021] Compared with the prior art, the beneficial effects of the present invention are as follows:
[0022] This invention analyzes the invertibility of the butterfly mapping in the early layers of number-theoretic transformations under limited input conditions, and selectively prunes the early layers that meet the conditions for inverse table lookup recovery, thereby constructing a compact factor graph of number-theoretic transformations. Compared to modeling all butterfly layers completely, this invention effectively eliminates redundant variable nodes and factor nodes that have limited effect in the inference process but significantly increase the computational burden. It reduces the inference scale from the source of the graph structure, decreases the number of message passes and intermediate result storage in belief propagation iterations, and thus reduces the time and space complexity of the inference process, improving the execution efficiency and engineering practicality of security assessments. This compact modeling method demonstrates its efficiency advantage, especially when target device resources are limited or batch testing is required.
[0023] Secondly, this invention, based on utilizing the bypass information inherent in the number-theory transformation process, further introduces bypass information from subsequent polynomial multiplication processes directly involved in the output of the number-theory transformation, forming supplementary observations of the same secret correlation coefficient. Since the basic multiplication kernel typically accesses and performs repeated operations on the same coefficient during execution, richer leakage evidence can be extracted from the second bypass curve. Combined with algebraic constraints under known parameters, candidate values are screened, reordered, and their probabilities updated, ultimately generating a second probability distribution. This mechanism overcomes the limitations of traditional methods that primarily rely on internal leakage from the number-theory transformation, effectively compensating for the weak, noise-sensitive, and unstable bypass information signals in early layers, thereby enhancing the ability to identify target intermediate variables.
[0024] Furthermore, this invention fuses the first probability distribution with the second probability distribution and uses the fused probability distribution as a priori condition for updating the number-theoretic transformation factor graph. This allows the graph inference process to utilize dual evidence simultaneously: direct observations from within the number-theoretic transformation and the external constraints of subsequent polynomial multiplication. Compared to a single information source, this fusion method maintains stronger anti-interference capabilities under complex and harsh noise conditions, reduces the spread of erroneous candidate values in iterative inference, improves the ranking stability and recovery success rate of the correct key correlation coefficient, and thus significantly enhances the reliability and robustness of the security assessment results.
[0025] Finally, this invention does not solely rely on the ability to recover the key as a single evaluation criterion. Instead, it comprehensively considers multiple core indicators, such as key recovery capability, inference complexity, and robustness under different noise intensities. These indicators include graph node compression rate, average inference time, number of iterations required for convergence, recovery performance under different noise conditions, and dependence on bypass information from early layer inputs. Based on these indicators, a more comprehensive, objective, and quantifiable security assessment strategy can be formed. This strategy not only reflects the actual leakage level of the target number theory transformation module in bypass analysis scenarios but also provides a more valuable reference for subsequent implementation optimization, bypass hardening design, and scheme selection. Therefore, it possesses strong innovation, practicality, and promotional value. Attached Figure Description
[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0027] Figure 1 A flowchart of a number theory transformation module security assessment method based on bypass analysis provided in an embodiment of the present invention;
[0028] Figure 2 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation
[0029] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0030] It should be noted that, unless otherwise specified, the features in the following embodiments and implementation methods can be combined with each other.
[0031] like Figure 1 As shown, this invention provides a security assessment method for Number Theoretic Transform (NTT) modules based on side-channel analysis. This method primarily targets side-channel leaks that occur when post-quantum cryptographic algorithms (such as lattice-based cryptosystems) are executed in physical devices. By jointly compressing the inference graph and using multi-source side-channel information, it achieves efficient and stable security assessment. The method includes:
[0032] Step S1: Collect several first bypass curves generated by the target device during the number-theory transformation process, and several second bypass curves generated during the polynomial multiplication process in which the output result of the number-theory transformation directly participates; construct a leakage template based on the first and second bypass curves.
[0033] Furthermore, in implementing this step, leakage modeling can first be performed on a reference device that is the same as or equivalent to the target device, so as to collect labeled training curves under controlled input conditions. The labels can be intermediate variable values of number-theoretic transformations, Hamming weights of these intermediate variables, or intermediate calculation result categories corresponding to subsequent polynomial multiplications. Based on the aforementioned labeled curve samples, a statistical model of each candidate value category in the feature space can be established as the basis for discrimination during subsequent template matching.
[0034] Furthermore, before constructing the leakage template based on the first bypass curve and the second bypass curve, in order to eliminate the interference of timing offset and environmental noise, the first bypass curve and the second bypass curve need to be preprocessed, including:
[0035] The first and second bypass curves are aligned, filtered, and segmented to obtain time window curve segments corresponding to the intermediate variables of the number theory transformation and the polynomial multiplication.
[0036] Specifically, the process of aligning and filtering the first and second bypass curves includes: aligning the curves using a trigger signal-based or feature point matching method, and using a low-pass or band-pass filter to filter out high-frequency ambient noise. For example, the sampling position of the same computational event in different curves can be kept consistent through external trigger pins, feature peak positions, cross-correlation maximum value positions, or dynamic time warping methods, thereby reducing intra-class differences during template training and template matching.
[0037] The process of segmenting the first and second bypass curves includes: dividing the time window according to the program execution trajectory, and extracting time window curve segments corresponding to the intermediate variables of the number theory transformation and the polynomial multiplication. For example, segments with adaptive lengths can be extracted as subsequent feature analysis objects based on the trigger positions of program nodes such as the butterfly operation of the number theory transformation, the kernel call of the basic multiplication, and register loading and writing back.
[0038] Step S2: Obtain the nodes and their connection relationships corresponding to the butterfly operations of the i to L layers in the number-theoretical transformation, and construct the number-theoretical transformation factor graph.
[0039] Specifically, number theory transformation is represented as a hierarchical structure consisting of multiple layers (total number of layers is L) of butterfly operations. To reduce the computational cost of inference, this embodiment abandons full graph modeling for the first few layers (early layers) and instead obtains the variable nodes and factor nodes corresponding to the butterfly operations of the i-L layers in the number theory transformation; where variable nodes represent intermediate variable values and factor nodes represent the algebraic constraint relationships of the butterfly operations.
[0040] The variable nodes and factor nodes are identified according to the level of the butterfly operation, the index of the intermediate variable, and the rotation factor. The connection relationship between the nodes, the candidate value range, and the message passing direction are clarified, thereby constructing a number theory transformation factor graph.
[0041] Using the above method, each butterfly operation can be mapped to a factor node, and the intermediate variables propagating across layers can be mapped to variable nodes, thus forming a multi-layered connected number-theoretic transformation factor graph. Compared with the method of modeling addition, subtraction, and multiplication constraints independently, the above factor node construction method can reduce local short cycles and improve the convergence efficiency of subsequent belief propagation.
[0042] It should be noted that the number-theoretic transformation factor graph constructed in this example does not fully expand the butterfly operation at all levels. Instead, considering the range of input data values, the invertibility of the butterfly mapping in early layers, and the redundancy of the inter-layer connection structure, only layers i to L are retained for graph inference. This avoids unnecessary explicit inference for early layers that meet the conditions for reverse table recovery. In this way, without weakening the secret recovery capability, the number of variable nodes, factor nodes, and message passing edges can be significantly reduced, thus lowering the computational burden of belief propagation.
[0043] Furthermore, when the input data of the number theory transformation module is [-3,3], i takes the value of 2; when the input data of the number theory transformation module is [-2,2], i takes the value of 3.
[0044] For example, the selection of the initial inference layer i can be dynamically adjusted based on the size of the algorithm's data (e.g., the dimension N of the polynomial ring). For instance, when the values of the input data are in a small range (e.g., ... When the forward mapping search tree is narrow, the reverse lookup burden is small. In this case, i is 3, that is, the number theory transformation factor graph is directly used to infer the 3rd to Lth layers, and the 1st to 2nd layers are reserved for the lookup stage; when the input data value is in a large range (e.g. When the complexity of inter-layer mapping increases, the forward derivation tree expands rapidly. To balance the graph size and table lookup overhead, i is set to 2, that is, the number theory transformation factor graph is used to infer the 2nd to Lth layers.
[0045] Furthermore, the selection of the aforementioned layer number is not arbitrary, but directly related to the invertibility of the early layer butterfly mapping over the restricted input domain. Taking an input data value range of [-2, 2] as an example, the first layer butterfly inputs a and b each have only 5 candidate values, therefore (a, b) have a total of 25 combinations; given a rotation factor, its output... A unique mapping relationship can be maintained on this restricted domain, so reverse recovery can be directly completed through a lookup table. When entering the second layer, although the number of candidate values for each node increases, reverse positioning can still be performed within the restricted range through a pre-computed table. Therefore, the first and second layers can be pruned from the explicit modeling of the factor graph. If the range of the input data values is [-3,3], then there are 49 combinations of input pairs in the first layer. The first layer can still maintain a low lookup table complexity, but the candidate space of the second layer increases significantly. Therefore, it is preferable to use the lookup table reverse mechanism only for the first layer, and to construct the number theory transformation factor graph starting from the second layer.
[0046] Furthermore, taking a typical 256-dimensional polynomial number-theory transformation as an example, when using full graph modeling, the number of variable nodes and factor nodes both increase rapidly with the number of layers. However, when using the compact factor graph modeling of this invention, the total number of variable nodes can be reduced from 2048 to 768, and the total number of factor nodes from 896 to 320 in the example implementation. The above values are merely illustrative examples; the actual number of nodes can vary depending on the scale of the number-theory transformation, the number of graph pruning layers, and the specific implementation structure, but they reflect the significant effect of this invention in compressing inference scale.
[0047] Step S3: Extract feature vectors about intermediate variables from the first bypass curve, perform template matching on the feature vectors based on the leaked template, and obtain the first probability distribution.
[0048] Specifically, feature vectors (such as principal component analysis (PCA) dimensionality reduction features or time-domain sampling points) related to the intermediate variables of the number-theory transformation are extracted from the preprocessed first bypass curve. These feature vectors are then input into the leakage template constructed in step S1 for template matching to obtain the first probability distribution of each candidate intermediate variable. This distribution represents the initial probabilistic evidence of leakage from the number-theory transformation module itself.
[0049] Furthermore, in the feature vector extraction stage, sampling points with high class discrimination can be selected to reduce the instability of covariance estimation caused by redundant dimensions.
[0050] Specifically, not all sampling points along the entire bypass curve are equally useful. This invention prioritizes retaining the waveform features that best reflect the differences in intermediate variables, thereby making the obtained first probability distribution more accurate and stable.
[0051] Step S4: Based on the second bypass curve, perform template matching through the leaked template to obtain the second probability distribution.
[0052] Specifically, since early layers of number-theoretic transformations often leak very little information, this embodiment introduces observation information from subsequent operations for enhancement. Step S4 includes:
[0053] In post-quantum cryptography algorithms, the output coefficients of NTT are frequently read and written multiple times during subsequent polynomial multiplication. By extracting the bypass information fragments that repeatedly access the same number-theoretic transformation domain coefficients from the second bypass curve;
[0054] The probability of candidate Hamming weights corresponding to each bypass information segment is obtained using the leaked template;
[0055] By combining the algebraic constraints of the known parameters (such as the specific values of the publicly disclosed rotation factors) in the polynomial multiplication, the enumerated candidate coefficient values are screened and reordered, and after multiple rounds of iteration, a second probability distribution of the corresponding number theory transformation domain coefficients is generated.
[0056] Furthermore, in this example, repeated access means that the output of the exponential transformation is referenced multiple times as an operand in the underlying multiplication kernel during subsequent polynomial multiplication. Therefore, the same secret correlation coefficient can be observed repeatedly across multiple time windows. Compared to sampling only at a single moment, this multiple observation mechanism reduces the impact of random noise on a single match result, thus making the probability estimation more focused.
[0057] Furthermore, the filtering and reordering process does not infinitely expand all candidate values, but rather preferably retains a finite number of high-confidence candidates. For example, three to five candidate Hamming weights that best match the second bypass curve can be retained first, and then candidate values can be enumerated within their respective value ranges. Filtering can be performed using known multipliers, known rotation factors, and modular algebraic relationships in polynomial multiplication, thereby reducing the computational load when generating the second probability distribution.
[0058] Furthermore, although the second bypass curve originates from the polynomial multiplication process after the number-theory transformation, the target it constrains is still the same set of number-theory transformation domain coefficients related to the output of the number-theory transformation. Therefore, the second probability distribution and the first probability distribution have the same candidate space, and can be directly fused in step S5.
[0059] Step S5: Fuse the first probability distribution and the second probability distribution to obtain the fused probability distribution.
[0060] Specifically, point-wise multiplication is performed on the probability values of the same candidate coefficient in the first probability distribution and the probability values in the second probability distribution. The results of the point-wise multiplication are then normalized to obtain a fused probability distribution. This fused probability distribution combines the advantages of direct internal observation and enhanced external constraints.
[0061] Furthermore, if the candidate space is Then the fusion probability distribution It can be represented as:
[0062]
[0063] in, Represents candidate values in the first probability distribution The corresponding probability value, Represents candidate values in the second probability distribution The corresponding probability value, Represents candidate values in the first probability distribution The corresponding probability value, Represents candidate values in the second probability distribution The corresponding probability values. Through the above point-by-point multiplication and normalization, two types of probabilistic evidence from different sources but targeting the same target variable can be organically integrated while maintaining the consistency of the candidate space.
[0064] Furthermore, to improve numerical stability, the above fusion process can also be performed in the logarithmic domain. For example, the log-likelihoods of the first and second probability distributions can be calculated separately, then multiplicative fusion can be achieved by addition, and finally, the fused probability distribution can be obtained through exponential mapping and normalization. For laypeople, this can be understood as follows: when a candidate value is supported by both types of evidence, its fused weight is significantly amplified; when a candidate value is supported by only one type of evidence and not the other, its weight is suppressed, making it easier for truly correct candidate values to stand out in subsequent inferences.
[0065] Step S6: Update the iterative number theory transformation factor graph using the fusion probability distribution as a priori condition.
[0066] Furthermore, in this embodiment, the fusion probability distribution is injected as a priori condition for the boundary variable nodes into the number-theoretical transformation factor graph, and the Belief Propagation (BP) algorithm is initiated to update the number-theoretical transformation factor graph iteratively. The stopping condition for this iterative inference includes at least one of the following:
[0067] The update iteration count reaches a preset threshold to prevent infinite loops;
[0068] The change in the posterior probability distribution of two adjacent iterations (such as the KL divergence between the posterior probability distributions of two adjacent iterations) is lower than a preset change threshold.
[0069] The key candidate ordering in the number-theoretic transformation factor graph remains stable over multiple iterations, meaning that the possible candidate values no longer change position.
[0070] Furthermore, because this invention prunes the early layers (such as the first and second layers), confidence propagation does not need to be performed on the complete factor graph, but only on a compact number-theoretic transformation factor graph. This reduces the number of messages involved in each iteration and also lowers the risk of information duplication and amplification caused by the loop structure in the graph.
[0071] Specifically, this invention first removes the parts that can be solved directly by looking up a table from the diagram, and only uses belief propagation for the parts that truly require probabilistic reasoning, thus making the calculation faster and the results more stable.
[0072] Step S7: After the number-theory transformation factor graph converges iteratively, the reliable marginal posterior distribution of the i-th layer is obtained, thereby initiating the table lookup reverse mechanism of the early layers:
[0073] Construct a lookup table (LUT) corresponding to the i-th layer butterfly operation. Obtain the variable node values of the i-th layer butterfly operation based on the updated number theory transformation factor graph and input them into the lookup table to reverse the variable node values of the (i-1)-th layer butterfly operation. Continue in this manner, backtracking layer by layer, and finally obtain the input of the first layer butterfly operation, thus successfully recovering the original key-related polynomial coefficients.
[0074] Furthermore, the lookup table can be pre-constructed offline based on the restricted input domain. For the ℓth level butterfly operation, if the input variable is... The output variable is The rotation factor is Then the following inverse mapping relationship can be established:
[0075]
[0076] in, , This represents the modulus of the finite field containing the coefficients of the ntt input. Within the constrained input range, if the mapping satisfies single-valued invertibility, (u,w) can be directly mapped back to (a,b), thus eliminating the need to perform graph inference on this layer.
[0077] Furthermore, when the range of input data values is [-2, 2], the first layer butterfly inputs a and b each have 5 candidate values, so the total number of input combinations is 25. The second layer, under the premise that the output of the previous layer can be reversibly recovered, can still complete the reverse lookup within a controllable complexity. Therefore, both the first and second layers can be retained as lookup stages. When the range of input data values is [-3, 3], the total number of input combinations in the first layer is 49, still suitable for reverse lookup; however, when further extended to deeper layers, the number of candidate combinations increases significantly, the collision probability increases, and the lookup efficiency decreases. Therefore, it is preferable to retain only the first layer as the lookup stage and start factor graph inference from the second layer.
[0078] Furthermore, in this step, the backtracking process from layer i to layer 1 is not a simple exhaustive search of all intermediate values. Instead, it uses the highest confidence or the top few high-confidence candidate values in the marginal posterior distribution of layer i as the lookup entry point, and recovers the data layer by layer by leveraging the inter-layer index mapping relationship. Since the accuracy of the variable nodes in layer i has been improved by using the fusion probability distribution and confidence propagation in the previous steps, this reverse lookup process has a higher recovery success rate and a lower error propagation probability.
[0079] Step S8: Evaluate the security of the number theory transformation module based on the recovered key.
[0080] Furthermore, based on the final recovered key result, a security quantitative evaluation report of the target number theory transformation module is output. The evaluation process comprehensively calculates and considers the following indicators:
[0081] Key recovery success rate is used to characterize the degree of leakage of the target number theory transformation module under bypass analysis conditions. For example, the key recovery success rate... It can be represented as:
[0082]
[0083] in, This represents the number of coefficients indicating that the correct key was successfully recovered. This represents the total number of coefficients for the key that needs to be recovered.
[0084] Average inference time and number of convergence iterations are used to characterize the inference complexity of the evaluation process. For example, the average inference time can be obtained by dividing the total time of multiple experiments by the number of experiments; the average number of convergence iterations... It can be represented as:
[0085]
[0086] in, This represents the total number of experiments. This represents the number of iterations when the number-theoretic transformation factor graph satisfies the stopping condition in the k-th experiment.
[0087] Key recovery performance under different noise intensities is used to characterize the robustness of the evaluation method to noisy environments. Specifically, after preprocessing the first and second bypass curves, Gaussian white noise of different intensities is superimposed to construct multiple noise test scenarios. For example, the signal-to-noise ratio (SNR) is set to 20 dB, 15 dB, 10 dB, 5 dB, 0 dB, and -5 dB. At each noise level, 20 independent key recovery experiments are repeated, and the key recovery success rate, average ranking of correct key coefficients, minimum number of bypass curves required to achieve the target recovery success rate, and average number of convergence iterations are statistically analyzed.
[0088] Among them, the average sorting of correct key coefficients It can be represented as:
[0089]
[0090] in, Indicates the first The ranking of the correct key in the candidate set in this experiment. The smaller the value, the better the recovery performance.
[0091] Minimum number of bypass curves required to achieve the target recovery success rate It can be represented as:
[0092]
[0093] in, Indicates use Key recovery success rate when using a bypass curve.
[0094] Furthermore, to quantify the degree of performance degradation caused by changes in noise conditions, a recovery performance degradation rate can also be defined. for:
[0095]
[0096] in, This represents the key recovery success rate under reference low-noise conditions, with the preferred value being... Recovery success rate at 20 dB; This indicates the key recovery success rate under the current noise conditions. The smaller the value, the slower the performance degradation of this evaluation method in a noisy environment, and the stronger its robustness.
[0097] Preferably, the evaluation method can be deemed to have strong noise robustness when at least three of the following conditions are met: Key recovery success rate at 10 dB No less than 90%; At 5 dB, No less than 80%; When it is 0 dB, No less than 70%; At -5 dB, No less than 50%; During the process of decreasing from 20 dB to 0 dB, the average sorting of the correct key coefficients Stay within the top 5; Minimum number of bypass curves required to achieve a 60% recovery success rate during the process of decreasing from 20 dB to 0 dB. The increase does not exceed 50%; during the process of SNR decreasing from 20 dB to 0 dB, the average number of convergence iterations... The increase will not exceed 30%.
[0098] The degree of dependence on early layer input bypass information is used to characterize the supplementary effect of the second probability distribution on the original bypass evidence. Specifically, multiple sets of comparative experiments can be set up, namely: retaining the complete early layer input bypass information and fusing it with the second probability distribution; attenuating the effective amplitude of the early layer input bypass information by 30% before fusing it with the second probability distribution; attenuating the effective amplitude of the early layer input bypass information by 50% before fusing it with the second probability distribution; and not using the early layer input bypass information at all, relying solely on the second probability distribution for inference. Each set of experiments is repeated 20 times for independent recovery experiments, and the key recovery success rate, the average ranking of correct key coefficients, and the minimum number of bypass curves required to achieve a 90% recovery success rate are statistically analyzed.
[0099] The degree of dependence on the bypass information of the early layer input can be expressed by the dependence coefficient. The dependence coefficient is quantified. It can be represented as:
[0100]
[0101] in, This represents the key recovery success rate when fully utilizing the bypass information from the early layer inputs. This indicates the key recovery success rate when bypassing early layer input information is not used. The larger the value, the stronger the dependence of the evaluation method on the bypass information of the early layer input; The smaller the value, the stronger the compensating ability of the second probability distribution for the original bypass evidence. Preferably, when When, it is judged as low dependency; when When, it is judged as a moderate dependency; when At that time, it was determined to be a high dependency.
[0102] The change in node size before and after compression of the number-theoretic transformation factor graph is used to characterize the space complexity optimization effect brought about by the compact number-theoretic transformation factor graph. For example, the number of variable nodes, the number of factor nodes, and the total number of connected edges in the graph before and after compression can be counted separately, and the node compression ratio can be calculated. The node compression ratio It can be represented as:
[0103]
[0104] in, This represents the total number of nodes before compression. This represents the total number of nodes after compression. The larger the value, the more significant the compression effect of the compact number theory transformation factor graph on the graph structure size, and the better the space complexity optimization effect.
[0105] Furthermore, this example can generate a quantitative security assessment report for the target number theory transformation module based on indicators such as key recovery success rate, average inference time, number of convergence iterations, key recovery performance under different noise intensities, dependence on early layer input bypass information, and / or changes in node size before and after compression of the number theory transformation factor graph. This allows for a comprehensive evaluation of its leakage level, inference complexity, noise robustness, auxiliary information compensation effect, and space complexity optimization in bypass analysis scenarios.
[0106] It should be noted that the method provided in this example addresses the side-channel leakage scenario that occurs when post-quantum cryptography algorithms are executed in actual physical devices. It is particularly suitable for implementations where number-theoretical transformations and subsequent polynomial multiplications are executed consecutively on the same processor or in the same cryptographic coprocessor module. In this scenario, the intermediate variables of the number-theoretical transformation itself leave a first side-channel curve in terms of power consumption, timing, electromagnetic radiation, or cache access behavior. Furthermore, the repeated loading, repeated reading and writing, and modular multiplication of the number-theoretical transformation output in subsequent polynomial multiplications create an additional second side-channel curve for the same secret correlation coefficient. This invention does not analyze each operational stage in isolation, but rather, by jointly utilizing multi-source side-channel information, compact factor graph modeling, and an early layer lookup table inverse mechanism, it enables the security assessment to simultaneously possess high recovery capability, low inference complexity, and good noise robustness.
[0107] In summary, this invention provides a security assessment method for number-theoretic transformation modules based on bypass analysis. By pruning early layers that satisfy the reverse recovery conditions of table lookup, a compact number-theoretic transformation factor graph is constructed. Redundant nodes are eliminated, and the number of iteration message passes is reduced, significantly lowering inference complexity and storage overhead, and improving assessment efficiency. This invention introduces bypass information from subsequent polynomial multiplication processes, utilizing the repeated access characteristics of coefficients combined with known algebraic constraints to generate a second probability distribution, effectively compensating for the weakness and instability of early layer signals. The first and second probability distributions are then merged and used as prior conditions for updating the number-theoretic transformation factor graph, enhancing the anti-interference capability of the target device in complex noise environments and improving the key recovery success rate. Finally, this invention comprehensively considers multiple core indicators such as key recovery capability, inference complexity (e.g., node compression rate, number of iterations), and noise robustness, providing a more objective and comprehensive security assessment strategy.
[0108] Accordingly, this application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the above-described method for security assessment of number theory transformation modules based on bypass analysis. Figure 2 The diagram shown illustrates a hardware structure of any device with data processing capabilities, where the security assessment method for the number theory transformation module based on bypass analysis, provided in this embodiment of the invention, is located. (Except for...) Figure 2 In addition to the processor, memory, and network interface shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.
[0109] Accordingly, this application also provides a computer-readable storage medium storing computer instructions, which, when executed by a processor, implement the aforementioned bypass analysis-based number theory transformation module security assessment method. The computer-readable storage medium can be an internal storage unit of any data processing device as described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units of any data processing device and external storage devices. The computer-readable storage medium is used to store the computer program and other programs and data required by the data processing device, and can also be used to temporarily store data that has been output or will be output.
[0110] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the disclosure herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only.
[0111] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.
Claims
1. A method for security assessment of number-theoretic transformation modules based on bypass analysis, characterized in that, The method includes: Several first bypass curves generated by the target device during the execution of number theory transformation, and several second bypass curves generated during the polynomial multiplication process in which the output of the number theory transformation directly participates; a leakage template is constructed based on the first and second bypass curves; Obtain the nodes and their connections corresponding to the butterfly operations at levels i to L in number-theoretical transformation, and construct a number-theoretical transformation factor graph; Based on the leakage template, feature matching is performed on the first bypass curve and the second bypass curve respectively to obtain the first probability distribution and the second probability distribution; The first probability distribution and the second probability distribution are fused together, and the resulting fused probability distribution is used as a priori condition to iteratively update the number theory transformation factor graph. Based on the pre-constructed lookup table corresponding to the i-th layer butterfly operation, the node values of the i-th layer butterfly operation are obtained according to the updated number theory transformation factor graph. The node values are input into the lookup table to reverse the node values of the (i-1)-th layer butterfly operation, and so on, layer by layer, to reverse the input of the first layer butterfly operation, thereby recovering the key. The security of the number theory transformation module is evaluated based on the recovered key.
2. The method for security assessment of number theory transformation modules based on bypass analysis according to claim 1, characterized in that, Before constructing the leakage template based on the first bypass curve and the second bypass curve, the following is also included: The first and second bypass curves are aligned, filtered, and segmented to obtain time window curve segments corresponding to intermediate variables of number theory transformation and polynomial multiplication.
3. The method for security assessment of number theory transformation modules based on bypass analysis according to claim 1, characterized in that, The process of constructing a number-theoretic transformation factor graph includes: Number theory transformations are represented as a hierarchical structure consisting of multiple layers of butterfly operations. For the i-th to L-th butterfly operations, each layer corresponds to several variable nodes and factor nodes. The variable nodes are used to represent intermediate variable values, and the factor nodes are used to represent the algebraic constraints of the butterfly operations. The variable nodes and factor nodes are identified according to the level of the butterfly operation, the index of the intermediate variable, and the rotation factor. The connection relationship between the nodes, the candidate value range, and the message passing direction are clarified, thereby constructing a number theory transformation factor graph.
4. The method for security assessment of number theory transformation modules based on bypass analysis according to claim 1 or 3, characterized in that, When the input data of the number theory transformation module is [-3,3], i takes the value of 2; when the input data of the number theory transformation module is [-2,2], i takes the value of 3.
5. The method for security assessment of number theory transformation modules based on bypass analysis according to claim 1, characterized in that, The process of obtaining the first probability distribution and the second probability distribution by performing feature matching on the first bypass curve and the second bypass curve based on the leakage template includes: The feature vectors of the intermediate variables are extracted from the first bypass curve, and the feature vectors are template matched based on the leaked template to obtain the first probability distribution; as well as, Extract the bypass information fragments that repeatedly access the coefficients of the same number theory transformation domain from the second bypass curve; The probability of candidate Hamming weights corresponding to each bypass information segment is obtained by using the leaked template; By combining the algebraic constraints of the known parameters in polynomial multiplication, the enumerated candidate coefficient values are screened and reordered, and after multiple rounds of iteration, the second probability distribution of the corresponding number theory transformation domain coefficients is generated.
6. The method for security assessment of number theory transformation modules based on bypass analysis according to claim 1, characterized in that, The process of fusing the first probability distribution and the second probability distribution to obtain the fused probability distribution includes: Perform point-by-point multiplication on the probability values of the same candidate coefficient value in the first probability distribution and the probability value in the second probability distribution; The result of point-by-point multiplication is normalized to obtain the fusion probability distribution.
7. The method for security assessment of number theory transformation modules based on bypass analysis according to claim 1, characterized in that, When iteratively updating the number-theoretic transformation factor graph using the fusion probability distribution as a prior condition, the iteration stopping condition includes at least one of the following: The number of update iterations has reached a preset threshold. The change between the posterior probability distributions of two consecutive iterations is less than a preset change threshold; The key candidate ranking in the number-theoretic transformation factor graph remains stable across multiple iterations.
8. The method for security assessment of number theory transformation modules based on bypass analysis according to claim 1, characterized in that, The process of assessing the security of the number theory transformation module based on the recovered key includes: The security of the number-theory transformation module is evaluated by calculating the key recovery success rate, average inference time, number of convergence iterations, key recovery performance under different noise intensities, dependence on early layer input bypass information, and / or node size changes before and after number-theory transformation factor graph compression.
9. An electronic device, characterized in that, include: At least one processor; as well as A memory that is communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor. When the computer program is executed by the at least one processor, it causes the at least one processor to perform the number theory transformation module security assessment method based on bypass analysis as described in any one of claims 1 to 8.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the number theory transformation module security assessment method based on bypass analysis as described in any one of claims 1 to 8.