An efficient formal verification method for mask circuits with multi-output composable security

Abstract

This invention discloses an efficient formal verification method for masked circuits with multi-output composable security. The steps include: generating a complete set of internal probes for the masked circuit using a security model, traversing each security level; enumerating all possible probe sets according to the current security level; calculating the corresponding leakage set for each enumerated probe set using the security model; simplifying the current leakage set if it is not empty; if a simulation set is found based on the simplified leakage set such that the probability distributions of the variables in the middle are statistically independent, then the next probe set is enumerated and the corresponding leakage set is calculated; if no suitable simulation set is found, the masked circuit is determined not to meet the given security concept, and the current leakage set is used as a counterexample, returning to the maximum security level. This invention provides accurate and reliable detection results and higher verification efficiency.

Description

Technical Field

[0001] This invention belongs to the field of side-channel protection and relates to an efficient formal verification method for multi-output composable security, which can be used to verify the security of side-channel protection. Background Technology

[0002] In modern society, cryptography has become a core pillar of information security, widely used in critical areas such as financial payments, identity authentication, communication encryption, and IoT devices. Although modern cryptography is theoretically considered to possess high security, advancements in cryptanalysis techniques have never ceased. Side-channel attacks are a method of stealing confidential data by analyzing physical information leaked during system operation (such as time, power consumption, electromagnetic radiation, and sound). These attacks do not directly target the mathematical security of the algorithm but rather exploit weaknesses in its physical implementation. Their attack scope covers various computing platforms, from smart cards and IoT devices to cloud servers, and has become one of the major threats to physical layer security.

[0003] Masking is a side-channel protection technique at the algorithmic logic level. Its core idea is to randomize the representation of intermediate data (such as keys or plaintext) to make physical leakage statistically independent of actual values. It offers advantages such as provably secure security, a systematic expansion mechanism, and greater stability at the implementation level, with relatively lower dependence on the characteristics of the implementation platform. However, designing and implementing masking protection mechanisms for side-channel analysis remains a highly manual, complex, and error-prone process. It requires not only a deep understanding of the execution environment but also careful consideration of physical and security models. Against this backdrop, much work focuses on formally modeling attackers and the physical environment to simplify and assist in the formal verification of security. Formal verification can analyze the netlist file obtained after RTL code logic synthesis of the masking scheme, automating the analysis of the masking scheme's security and correctly determining its security. Automated verification of masking scheme security is of great significance.

[0004] To evaluate the security of mask protection, researchers have proposed various security analysis models and concepts, among which the most commonly used include the detection model and its corresponding detection security and non-interference security. Based on the physical characteristics of information leakage in circuits, the detection model can be further divided into the standard detection model and the glitch detection model. The standard detection model ignores information leakage caused by glitches, assuming that an attacker can observe the probability distribution of a certain variable through a single probe, thus it is suitable for the security analysis of software masks. The glitch detection model, on the other hand, considers the information leakage caused by glitches; an attacker can obtain the joint distribution of multiple variables related to the glitch through a single probe, thus it is more suitable for the security analysis of hardware masks.

[0005] Probe security is the most fundamental property required to ensure the security of a masking scheme, but its main limitation lies in its lack of composability. That is, combining two independent modules that satisfy probe security may not guarantee overall probe security. In contrast, non-interference security overcomes this deficiency, offering better composability. Modules satisfying properties such as non-interference (NI), strong non-interference (SNI), or probe-isolated non-interference (PINI) can maintain their respective security after combination. In specific verification, the non-interference security model introduces the concept of a "simulation set," which is viewed as a simulated representation of the secret variables. During verification, it is necessary to check whether the joint distribution of the probe set is statistically independent of the variables in the simulation set. If they are independent, the system is considered secure.

[0006] In the research on formal verification of security implementation using hardware masks, existing work mainly follows three technical routes: Fourier coefficient estimation, programming language-based methods, and statistical independence verification methods.

[0007] In 2018, Bloem et al. implemented an automated tool using the idea of ​​Fourier coefficient estimation to formally verify masking schemes and their implementations under basic and glitch propagation-considered detection models. However, due to the computational limitations of Fourier coefficient estimation, this tool is mainly applicable to first-order security analysis and cannot handle higher-level security concepts such as NI, SNI, and PINI. In 2019, Barthe et al. proposed a programming language-based formal verification tool, maskVerif, which uses probabilistic information flow to evaluate the security of masking schemes and their implementations. Through a conservative heuristic method and an optimistic sampling strategy, maskVerif outperforms Bloem et al.'s tool in execution efficiency, but may still produce a certain number of false positives in nonlinear scenarios. In 2020, Knichel et al. proposed the formal verification tool SILVER, which uses ROBDD to exhaustively analyze the circuit probability distribution and its statistical independence, enabling the verification of the security of masked circuits while considering glitches. This method avoids false positives and, for the first time, uniformly supports the accurate verification of mainstream security concepts such as spur detection security, NI, SNI, and PINI. It can also efficiently detect the uniformity of output sharing, but its speed and scalability are significantly reduced.

[0008] Existing mask security verification tools have shortcomings in terms of security concept coverage: for example, maskVerif cannot verify the security of single-output and multi-output PINI, while SILVER only supports the verification of single-output SNI and PINI, lacking the ability to verify multi-output SNI and multi-output PINI.

[0009] To illustrate this invention in detail, two data structures are introduced: a support variable set `supp` and a perfect mask set `perf`. For gates in a circuit... ,supp( ) indicates a door The output expression of perf is the set of all input variables that appear in the expression, including the shared share of the secret variable and the random number. ) indicates a door The output expression contains a set of variables that can serve as a perfect mask. These variables are uniformly and independently distributed random variables that appear only once in the output expression, ensuring a uniform distribution.

[0010] like If it is an in or ref gate, then supp( ) is the variable it stores; if If it is a reg, out, or ¬ gate, then supp( ) equals its subgate's sup, if If it is a binary gate (such as ∧, ⊕, etc.), then supp( ) is the union of the supps of its left and right sub-gates.

[0011] like It's an in, ref gate, perf( ) is the variable it stores (if If the variable in the middle is the last shared share, then perf( ) is the former (shared share); if If it is a reg, out, or ¬ gate, then perf( ) equals the perf of its subgates; if If it is ⊕ or ⊖, then perf( ) is the union of the parts of the perfect masks of the left and right sub-gates that are not in the support vector set of the other; for other gates (such as ∧, ∨, etc.), perf( () is empty. Summary of the Invention

[0012] In view of the problems existing in the prior art, the purpose of this invention is to provide an efficient formal verification method for multi-output composable security.

[0013] The technical solution of this invention is as follows: An efficient formal verification method for mask circuits with multi-output composable security, comprising the following steps: Using security models Generate the mask circuit to be verified. Complete collection of internal exploration traverse each security level ; Based on the current security level Enumerate all possible ones in turn. -Detection set Each of the above -Detection set include -Internal detection set and -External probe set; for each enumerated... -Detection set Using security models Calculate the corresponding leak set ; If the current leak set If it is not an empty set, then simplify it; If based on the simplified leak set Find the simulation set , making The probability distribution of the variables in the middle and If the probability distributions of the variables are statistically independent, then enumerate the next... -Detection set And calculate the corresponding leak set. ;in, , Indicates mask circuit Input The set of shares corresponding to all bits; if no matching simulation set can be found. Then determine the mask circuit. Does not meet the given security concept and the current leak set As a counterexample, return to the maximum safe level. ; Based on the current security level All of them are enumerated in sequence. -Detection set Corresponding leak set If a corresponding simulation set S can be found for each, then the current security level will be... Increase by 1.

[0014] Preferably, the -The internal probe set includes the entire internal probe set. Selected from An internal probe set, based on the concept of security. and mask circuit Output generate -External probe set; .

[0015] Preferably, if the concept of security For strong non-interference SNI, then from the output Each bit Select from each share Composition of shares -External probe set If the concept of security To isolate non-interfering PINIs from probes, select from the entire share index set. An index set consists of several indexes. For output For each bit, take the index at... The share within constitutes -External probe set .

[0016] Preferably, if the security model For the standard detection model, then -Detection set Corresponding leak set for -Detection set .

[0017] Preferably, if the security model For the spurious extended detection model, the leakage set is... , where the function mask circuit The door in the middle Mapped as a mask circuit Middle of the door The set of register gates that directly contribute to the output calculation.

[0018] Preferably, for the leak set The simplified method is to traverse the leak set. elements in Determine its perfect mask set perf( If the number of elements in the array is greater than 0, then check if the number of elements in the array is greater than 0. The perfect mask set perf With elements support variable set supp( If the difference set is empty, then from the leaked set... Delete the current element Otherwise, determine the leaked set. The next element.

[0019] A high-efficiency formal verification system for masked circuits with multi-output composable security is characterized by comprising an internal probe full set generation module, a leakage set generation module, a leakage set simplification module, and a security verification module. The internal detection full set generation module is used to utilize the security model. Generate the mask circuit to be verified. Complete collection of internal exploration ; The leak set generation module is used to generate the leak set based on the current security level. Enumerate all possible ones in turn. -Detection set Each of the above -Detection set include -Internal detection set and -External probe set; for each enumerated... -Detection set Using security models Calculate the corresponding leak set ; The leakage set simplification module is used to detect the current leakage set. Check if it is an empty set; if not, simplify it. The security verification module is used to verify the simplified leak set. Find the simulation set , making The probability distribution of the variables in the middle and The probability distributions of the variables are statistically independent; among them, , Indicates mask circuit Input The set of shares corresponding to all bits; if no matching simulation set can be found. Then determine the mask circuit. Does not meet the given security concept and the current leak set As a counterexample, return to the maximum safe level. .

[0020] A computing device, characterized in that it comprises: a processor and a memory storing a computer program, wherein the computer program, when run by the processor, executes the method described above.

[0021] A computer-readable storage medium, characterized in that it stores instructions that, when executed on a computer, cause the computer to perform the above-described method.

[0022] The advantages of this invention are as follows: 1) The modeling is more accurate. This invention strictly follows the theoretical definitions of multi-output SNI and PINI to enumerate the probe set, and the detection results are accurate and reliable.

[0023] 2) Higher verification efficiency: This invention proposes a new reduction rule to remove redundant variables in the probe set before verification, thereby reducing the computational complexity of the core statistical independence check. Attached Figure Description

[0024] Figure 1 The algorithm flowchart is shown below.

[0025] Figure 2 This is a system diagram of the present invention. Detailed Implementation

[0026] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0027] For a given hardware masking scheme, a heuristic reduction method is presented for the probe set detected by an adversary using probes. By heuristically finding that the simulated set and the probe set are statistically independent, the security of the probe set is proven. This invention provides a novel method for verifying the side-channel composable security of masked implementations, capable of efficiently verifying the security of masked implementations of multi-output SNI and multi-output PNI.

[0028] To achieve the above objectives, the technical solution of the present invention is an efficient formal verification method for multi-output composable security, which includes the following steps: 1) For a given mask circuit to be verified Security concept (SNI or PINI), Input Output and security model (Standard detection model or glitch propagation detection model), steps 2) to 5) determine whether the mask circuit meets the given security concept. .

[0029] 2) Generate mask circuit based on security model Complete collection of internal exploration And set the current verification security level. Proceed to step 3). For the standard detection model, Includes all gates except register gate (reg) and output gate (out); for the glitch propagation detection model, It contains only register gates of type reg. Each gate in the algorithm corresponds to an internal probe set, which serves as an intermediate variable for the calculation of that gate. The external probe set is determined by the security concept. definition.

[0030] 3) For a given current security level Enumerate all possible ones in turn. -Detection set For each of the enumerations Calculate the corresponding leak set ,Will (As input, proceed to step 4). -Detection set include -Internal probe set (denoted as )and -External probe set (denoted as Two parts, of which .in for A size is A subset of. For different security concepts. In other words, The calculation process differs. For SNI, the output... Each bit Select from each share Composition of shares For PNI, first start from the share index set {0,1, Select from} An index set consists of several indexes. For output For each bit, take the index at... The share within constitutes .according to and security model Calculate the leak set .like For the standard detection model, then ;like For the spur extension detection model, then , where the function Gates in the circuit Mapped to gates in a circuit The set of register gates that directly contribute to the output calculation.

[0031] 4) For the given information in step 3), ,when Simplify the set if it is not empty. Traverse elements in Determine its perfect mask set perf( Does the number of elements in ) be greater than 0? If it is greater than 0, then Simplify if necessary, otherwise check The next element in the middle. If It can be simplified for each element (i.e., mask circuit) The door in the middle ), determine whether it was not present Perfect mask protection in, i.e., judging perf with supp ( The difference set of () is not empty. If the difference set is empty, then from Delete from middle and the updated set Recursively execute step 4).

[0032] 5) For the simplified version after step 4) If a simulation set is found , making The probability distribution of the variables in the middle and The probability distributions of the variables are statistically independent (where...) , Indicates all inputs (The set of shares corresponding to all bits), then return to step 3) to determine the next one to be enumerated. If not found Then determine the mask circuit. If the given security criteria are not met, return the current set of leaks. As a counterexample, the maximum safe level is also returned. If for all of the enumerated in step 3). If a corresponding simulation set can be found, then... Increase by 1, and re-enter step 3 as the current safe level.

[0033] In one embodiment, in step 4), after obtaining a specific leak observation... Subsequently, to reduce the complexity of subsequent statistical independence verification, the verification process calls a reduction algorithm to recursively remove redundant probe points, i.e., the current element, using the property of a perfect mask. If a detection point Contains a unique random number (Right now If it does not appear in any other detection points, then it will from Removed from the middle. By inspecting each probe point. The perfect mask set perf( ), and ensure that the random numbers within it perf( The set of support variables not found at other probe points (supp) The algorithm identifies and removes probes with unique random numbers to determine if they can be removed. It continuously reduces the size of the probe set by recursively identifying and removing such probes until it can no longer be simplified. This process is repeated recursively until the probe set can no longer be simplified.

[0034] like Figure 2 As shown, an embodiment of the present invention provides an efficient formal verification system for mask circuits with multi-output composable security, characterized in that it includes an internal probe full set generation module, a leakage set generation module, a leakage set simplification module, and a security verification module; The internal detection full set generation module is used to utilize the security model. Generate the mask circuit to be verified. Complete collection of internal exploration ; The leak set generation module is used to generate the leak set based on the current security level. Enumerate all possible ones in turn. -Detection set Each of the above -Detection set include -Internal detection set and -External probe set; for each enumerated... -Detection set Using security models Calculate the corresponding leak set ; The leakage set simplification module is used to detect the current leakage set. Check if it is an empty set; if not, simplify it. The security verification module is used to verify the simplified leak set. Find the simulation set , making The probability distribution of the variables in the middle and The probability distributions of the variables are statistically independent; among them, , Indicates mask circuit Input The set of shares corresponding to all bits; if no matching simulation set can be found. Then determine the mask circuit. Does not meet the given security concept and the current leak set As a counterexample, return to the maximum safe level. .

[0035] An embodiment of the present invention provides a computing device, characterized in that it includes: a processor and a memory storing a computer program, wherein the computer program is executed by the processor to perform the above-described method.

[0036] An embodiment of the present invention provides a computer-readable storage medium, characterized in that it stores instructions that, when executed on a computer, cause the computer to perform the above-described method.

[0037] The following two examples illustrate the specific implementation techniques of the present invention, but do not limit the scope of the present invention in any way.

[0038] Multi-output SNI verification example: For finite fields Multiplication in The verification process of this invention is introduced by verifying whether 1-SNI is satisfied under the glitch detection model. Its output is 2 bits. The formula is as follows: Its first-order masking scheme is shown below, where the input shares are Its output share is .

[0039] in, , , , .

[0040] To verify 1-SNI, we need to discuss different cases.

[0041] when 1, At 0, the probe set can be simulated by at most one input share. Verifying each variable individually reveals that this condition satisfies the definition of 1-SNI.

[0042] when 0, At 1, the probe set can be simulated without using input shares. Since the above multiplication is multi-output, to strictly verify 1-SNI according to the definition, it is necessary to perform the multiplication from the outputs separately. and One share is taken from each of the two groups for verification, which means verification is required. These four probe sets are secure. We consider the probe sets. The enemy will simultaneously obtain and Addition yields .when When, the result of the above formula is always 0; while when When, the result of the above formula is It is uniformly distributed. The distribution of results differs depending on the value, thus the secret information is leaked. Therefore, the above multiplication does not satisfy the SNI of multiple outputs.

[0043] Example of detection intensive reduction: Suppose there is a probe set .

[0044] First recursion: examine Its perfect mask set → Skip; examine Its perfect mask set Check other detection points. Not here Find unique random numbers in the support vector set. ; Remove , .

[0045] Second recursion: examine Its perfect mask set → Skip; examine Its perfect mask set Check other detection points. Not here Find unique random numbers in the support vector set. ; Remove , .

[0046] Third recursion: examine Its perfect mask set → Skip; examine Its perfect mask set Check other detection points. Not here Find unique random numbers in the support vector set. ; Remove , .

[0047] Fourth recursion: If the perfect mask set of all elements in the array is empty, return 0. .

[0048] Final simplified result: .

[0049] The above are preferred embodiments of the present invention. It should be noted that, for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An efficient formal verification method for mask circuits with multi-output composable security, comprising the following steps: Using security models Generate the mask circuit to be verified. Complete collection of internal exploration traverse each security level ; Based on the current security level Enumerate all possible ones in turn. -Detection set Each of the above -Detection set include -Internal detection set and -External probe set; for each enumerated... -Detection set Using security models Calculate the corresponding leak set ; If the current leak set If it is not an empty set, then simplify it; If based on the simplified leak set Find the simulation set , making The probability distribution of the variables in the middle and If the probability distributions of the variables are statistically independent, then enumerate the next... -Detection set And calculate the corresponding leak set. ;in, , Indicates mask circuit Input The set of shares corresponding to all bits; if no matching simulation set can be found. Then determine the mask circuit. Does not meet the given security concept and the current leak set As a counterexample, return to the maximum safe level. ; Based on the current security level All of them are enumerated in sequence. -Detection set Corresponding leak set If a corresponding simulation set S can be found for each, then the current security level will be... Increase by 1.

2. The method according to claim 1, characterized in that, The -The internal probe set includes the entire internal probe set. Selected from An internal probe set, based on the concept of security. and mask circuit Output generate -External probe set; .

3. The method according to claim 1 or 2, characterized in that, If the concept of security For strong non-interference SNI, then from the output Each bit Select from each share Composition of shares -External probe set If the concept of security To isolate non-interfering PINIs from probes, select from the entire share index set. An index set consists of several indexes. For output For each bit, take the index at... The share within constitutes -External probe set .

4. The method according to claim 1, characterized in that, If the security model For the standard detection model, then -Detection set Corresponding leak set for -Detection set .

5. The method according to claim 1, characterized in that, If the security model For the spurious extended detection model, the leakage set is... , where the function mask circuit The door in the middle Mapped as a mask circuit Middle of the door The set of register gates that directly contribute to the output calculation.

6. The method according to claim 1, characterized in that, For leak sets The simplified method is to traverse the leak set. elements in Determine its perfect mask set perf( If the number of elements in the array is greater than 0, then check if the number of elements in the array is greater than 0. The perfect mask set perf With elements support variable set supp( If the difference set is empty, then from the leaked set... Delete the current element Otherwise, determine the leaked set. The next element.

7. A high-efficiency formal verification system for masked circuits with multi-output composable security, characterized in that, It includes an internal detection full set generation module, a leak set generation module, a leak set simplification module, and a security verification module; The internal detection full set generation module is used to utilize the security model. Generate the mask circuit to be verified. Complete collection of internal exploration ; The leak set generation module is used to generate the leak set based on the current security level. Enumerate all possible ones in turn. -Detection set Each of the above -Detection set include -Internal detection set and -External probe set; for each enumerated... -Detection set Using security models Calculate the corresponding leak set ; The leakage set simplification module is used to detect the current leakage set. Check if it is an empty set; if not, simplify it. The security verification module is used to verify the simplified leak set. Find the simulation set , making The probability distribution of the variables in the middle and The probability distributions of the variables are statistically independent; among them, , Indicates mask circuit Input The set of shares corresponding to all bits; if no matching simulation set can be found. Then determine the mask circuit. Does not meet the given security concept and the current leak set As a counterexample, return to the maximum safe level. .

8. A computing device, characterized in that, include: A processor, a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, Store instructions that, when executed on a computer, cause the computer to perform the method as described in any one of claims 1 to 6.

Images