A method and system for ml-kem unencapsulation side-channel protection

Abstract

The application provides an ML-KEM unencapsulation side channel protection method and system, relates to the field of hardware circuit information security, and the application acquires the cross-correlation spectrum of input ciphertext and a pre-stored public key in a frequency domain cross-correlation detection, compares the ratio of the spectrum peak value and the background noise mean value with a preset threshold value, judges whether the input ciphertext is a rotating camouflage attack ciphertext, adds dynamic random noise conforming to the central binomial distribution law at a polynomial subtraction calculation link if the judgment is a normal compliant ciphertext, generates a random permutation table by relying on a true random number generator at a polynomial coefficient processing stage, disarranges the processing order of each coefficient, simultaneously adds a redundant operation completely consistent with the true operation according to a pre-set probability, directly stops all decryption operation processes and outputs a random key to the outside if the judgment is an attack type ciphertext. The application can effectively resist the selected ciphertext side channel attack and realizes the calculation substantial immunity.

Description

Technical Field

[0001] This application relates to the field of hardware circuit information security technology, and in particular to an ML-KEM decapsulation side-channel protection method and system. Background Technology

[0002] With the rapid development of quantum computing technology, traditional encryption algorithms based on public-key cryptography (such as RSA and ECC) face a serious threat of being completely cracked. To address this, the National Institute of Standards and Technology (NIST) released the Post-Quantum Cryptography (PQC) standard in August 2024, in which the ML-KEM algorithm based on modular lattice theory was officially standardized as the only standard for asymmetric key encapsulation mechanism.

[0003] However, cryptographic chips generate side-channel physical leaks such as energy consumption and electromagnetic radiation during operation. In recent years, researchers have proposed a novel Choice Ciphertext (CCA) attack method. Attackers can completely bypass traditional ciphertext integrity checks and decapsulation failure checks by spoofing and adding noise to low-entropy malicious ciphertext using a public key or its rotational variants. The attackers measure the Hamming weight of the decryption intermediate results (such as a noisy message polynomial) with high precision through the side channel and construct a linear inequality system targeting the private key and the error polynomial based on its two's complement properties. Finally, utilizing a powerful backend "Greedy Solver," the attacker can efficiently solve for the correct private key using only a few hundred physical trajectories.

[0004] While traditional high-level masking protection methods can sever statistical dependencies against this new type of attack, they introduce extremely large computational overhead and storage resource expansion in hardware, making them difficult to deploy on resource-constrained devices such as edge devices. Existing lightweight detection solutions, on the other hand, cannot effectively intercept such highly concealed compliance-spoofed ciphertext. Summary of the Invention

[0005] This application aims to at least partially address one of the technical problems in the related art.

[0006] This application proposes an ML-KEM decapsulation side-channel protection method and provides a cross-layer collaborative multi-dimensional hybrid-shield hardware protection architecture. Its core idea is to utilize the fault tolerance space (noise budget) of the ML-KEM algorithm itself to pollute the quality of the data collected by the attacker, filling the attacker's inequality system with erroneous constraints, thereby disrupting the convergence conditions of the backend solver. This application mainly includes the following three core collaborative protection strategies.

[0007] Another aspect of this application proposes an ML-KEM decapsulation side-channel protection system.

[0008] To achieve the above objectives, the first aspect of this application proposes an ML-KEM decapsulation side-channel protection method, comprising: Obtain the cross-correlation spectrum of the input ciphertext and the pre-stored public key in the frequency domain cross-correlation detection, and compare the ratio of the peak value of the spectrum to the mean value of the background noise with a preset threshold to determine whether the input ciphertext is a ciphertext for a rotation spoofing attack. If the text is determined to be normal and compliant encrypted, dynamic random noise that conforms to the central binomial distribution is added to the polynomial subtraction calculation stage. In the polynomial coefficient processing stage, a random permutation table is generated by a true random number generator to shuffle the processing order of each coefficient. At the same time, redundant calculations with power consumption levels completely consistent with the actual calculations are randomly added according to a pre-set probability. If the ciphertext is determined to be malicious, the entire decryption process is stopped immediately, and a random key is output.

[0009] In one embodiment of this application, the step of obtaining the cross-correlation spectrum of the input ciphertext and the pre-stored public key in frequency domain cross-correlation detection, and comparing the ratio of the peak value of the spectrum to the mean value of the background noise with a preset threshold to determine whether the input ciphertext is a rotation spoofing attack ciphertext, includes: The number theory transformation hardware acceleration unit built into the ML-KEM module is reused to synchronously calculate the frequency domain data corresponding to the input ciphertext polynomial, while reading the pre-saved public key frequency domain data from the storage unit. In the frequency domain, pointwise multiplication and conjugate operations of the two sets of data are performed to obtain cross-correlation spectrum data. The inverse number theory transform hardware unit is then called to convert the cross-correlation spectrum into time domain data. Extract the maximum absolute value among all temporal similarity values, and then calculate the ratio of this value to the average absolute value of all temporal data, as a feature statistic for determining attack behavior; The threshold for anomaly detection is set at five times three standard deviations of the inherent Gaussian noise in the environment. When the feature statistics exceed this threshold, it is determined that there is a malicious structured spoofing attack. If the feature statistics do not exceed this threshold, it is determined to be compliant encrypted text.

[0010] In one embodiment of this application, the maximum absolute value among all temporal similarity values ​​is extracted, and then the ratio of this value to the average absolute value of all temporal data is calculated as a feature statistic for determining attack behavior. Each coefficient of temporal similarity can directly reflect the algebraic similarity between the input ciphertext and the public key under various rotation angles.

[0011] In one embodiment of this application, the step of adding dynamic random noise conforming to the central binomial distribution law to the polynomial subtraction calculation stage if the text is determined to be normal and compliant includes: The core polynomial subtraction operation logic of the decryption core was modified, and defensive noise was superimposed on the original intermediate calculation results of the decryption before the modular operation was completed. All defense noise values ​​are generated independently by sampling according to the central binomial distribution law; Whenever the noise sampling process is initiated, the initial seed required for sampling is regenerated by the physical true random number generator built into the cryptographic chip.

[0012] In one embodiment of this application, all defense noise values ​​are independently sampled and generated according to the central binomial distribution, wherein the central binomial distribution is configured with fixed parameters, and the maximum absolute value of a single set of defense noise values ​​generated therefrom is 4.

[0013] In one embodiment of this application, the polynomial coefficient processing stage utilizes a true random number generator to generate a random permutation table, shuffling the processing order of each coefficient. Simultaneously, redundant computations with power consumption levels completely identical to the actual computation are randomly added according to a pre-set probability, including: Before the polynomial coefficient subtraction loop starts, the circuit calls a true random number generator to generate random permutation factors, runs the Fisher-Yates out-of-order algorithm, generates a completely uniformly distributed random permutation mapping table, and changes the original polynomial logic iteration order from sequential execution to a discrete out-of-order processing mode based on random index pointers. In each out-of-order iteration, the timing fuzzer dynamically and randomly interleaves redundant clock operations based on the probability control bits generated by the true random number generator with preset probability parameters.

[0014] In one embodiment of this application, in the dynamic and random interleaving of redundant clock operations with preset probability parameters, the inserted redundant operation execution path has the same instruction cycle number, the same bus access logic, and the same operand expected Hamming weight as the real decryption calculation path, and operates in an idle register without changing the architecture state value.

[0015] In one embodiment of this application, the step of directly stopping the entire decryption operation process and outputting a random key if the ciphertext is determined to be an attack-type ciphertext includes: the circuit performs a forced interruption and triggers an implicit rejection mechanism, immediately returning a meaningless random pseudo-key to the subsequent stage.

[0016] Furthermore, to implement the above embodiments, this application proposes an ML-KEM decapsulation side-channel protection system, comprising: an ML-KEM decryption kernel, a frequency domain algebraic anomaly detection module (AAD), a dynamic noise injection module (DNI), a time fuzzer (TO), a physical true random number generator (TRNG), and a timing control module; wherein, The ML-KEM decryption kernel integrates a number theory transform NTT accelerator, an inverse number theory transform INTT accelerator, and a polynomial subtraction operation core, which are used to perform the basic operations of ML-KEM standard decapsulation. The frequency domain algebraic anomaly detection module (AAD) is configured at the system data input end. It uses the NTT accelerator and the INTT accelerator to complete the frequency domain cross-correlation operation, calculates the cross-correlation spectrum between the input ciphertext polynomial and the pre-stored public key polynomial, solves the ratio of the peak value of the spectrum to the mean value of the background noise and compares it with a preset threshold to identify the ciphertext of the rotation spoofing attack based on the public key cyclic shift. The timing control module is interconnected with the frequency domain algebra anomaly detection module (AAD). When AAD determines that the input ciphertext is an attack-type ciphertext, the timing control module cuts off the subsequent operation path, terminates the entire decryption process, and controls the system to output a random key. The Dynamic Noise Injection Module (DNI) is deployed inside the polynomial subtraction operation core and connected to the TRNG. After the AAD determines that the text is compliant and encrypted, the TRNG refreshes the noise sampling seed in real time, generates dynamic random noise that follows a central binomial distribution, and superimposes it onto the intermediate calculation result of the polynomial subtraction. The time fuzzer TO is connected to TRNG and timing control module respectively. During the polynomial coefficient cyclic processing stage, TRNG is called to run Fisher-Yates scrambling algorithm to generate random permutation table to shuffle the hardware processing order of polynomial coefficients. At the same time, timing control module inserts redundant dummy clock operations with power consumption, running cycle and actual operation completely equivalent according to preset probability to realize time domain trajectory confusion.

[0017] The methods and systems in this application abandon the high-overhead full masking scheme. The core purpose is to fundamentally block the convergence of the attacker's backend greedy solver by destroying the quality of the physically leaked data in the side channel.

[0018] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0019] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart of an ML-KEM decapsulation side-channel protection method provided in this application embodiment.

[0020] Figure 2 This is a structural diagram of an ML-KEM decapsulation side-channel protection system provided in an embodiment of this application. Detailed Implementation

[0021] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0023] The following describes, with reference to the accompanying drawings, an ML-KEM decapsulation side-channel protection method and system proposed according to embodiments of this application.

[0024] Example 1 like Figure 1 As shown, this ML-KEM decapsulation side-channel protection method specifically includes the following steps: S1. Obtain the cross-correlation spectrum of the input ciphertext and the pre-stored public key in the frequency domain cross-correlation detection, and compare the ratio of the peak value of the spectrum to the mean value of the background noise with the preset threshold to determine whether the input ciphertext is a rotation spoofing attack ciphertext.

[0025] In this embodiment, frequency domain cross-correlation detection is performed on the input ciphertext. The cross-correlation spectrum between the input ciphertext and the pre-stored public key is calculated using number theory transformation. Based on whether the ratio of the peak value of the spectrum to the mean value of the background noise exceeds a preset threshold, it is determined whether the input ciphertext is a ciphertext for a rotation spoofing attack.

[0026] Specifically, to counter attackers' strategies of masquerading as malicious low-entropy ciphertext by superimposing public keys or their negative ring shift variants onto them, this step abandons the traditional time-domain high-overhead Euclidean distance search and adopts a frequency-domain cross-correlation detection algorithm. The hardware circuit directly reuses the existing number-theoretic transform (NTT) hardware accelerator in the ML-KEM kernel. In a single computation path, the frequency-domain representation of the input ciphertext polynomial u is computed in parallel, and the pre-computed pre-stored public key frequency-domain representation is read from memory. Then, the cross-correlation spectrum of the two is rapidly calculated in the frequency domain. The inverse number-theoretic transform accelerator is then called to restore the cross-correlation spectrum to the time domain, obtaining polynomial coefficients that can directly map the algebraic similarity between the input ciphertext and the public key at different rotation angles. Furthermore, the ratio of the maximum absolute value of the time-domain similarity vector to the mean of the background noise is calculated to obtain a feature determination statistic, which is then compared with a preset anomaly detection threshold. If the statistic exceeds the threshold, it is determined to be a malicious structured spoofing attack. The circuit will be forcibly interrupted and an implicit rejection mechanism will be triggered, immediately returning a meaningless random pseudo-key to the subsequent stage, cutting off the path of key-dependent physical leakage at the source. If the statistic does not exceed the threshold, it is considered compliant ciphertext and allowed to enter the subsequent decryption process.

[0027] As one implementation method, the preset threshold can be set to five times the standard deviation of the environmental Gaussian noise floor, so as to avoid misjudgment while ensuring detection sensitivity.

[0028] This step achieves rapid and accurate identification of ciphertexts subjected to rotational spoofing attacks through frequency domain cross-correlation detection, reducing the complexity of the full-angle search from O(n²) to O(n log n). Without introducing a large area of ​​multipliers, it can intercept all rotational spoofing attacks in a single calculation, effectively blocking the attack path from the input domain and providing a reliable security pre-filter for the subsequent decryption process.

[0029] S2, if it is determined to be a normal and compliant encrypted text, add dynamic random noise that conforms to the central binomial distribution law in the polynomial subtraction calculation stage.

[0030] Specifically, after the input ciphertext is determined to be normal ciphertext through frequency domain cross-correlation detection, this method introduces a dynamic random noise injection mechanism in the polynomial subtraction operation. This mechanism utilizes the inherent decryption fault tolerance space of the ML-KEM algorithm to inject dynamic random noise following a specific probability distribution into the intermediate result during the core polynomial subtraction operation of the decryption path. Each coefficient of this noise is independently sampled from a central binomial distribution, and the seed used to drive the sampling of this central binomial distribution is dynamically refreshed by a hardware-built-in true random number generator each time the decryption is called. This ensures that even with identical ciphertext input, the physical leakage characteristics generated by each execution exhibit random variations over time. In this way, this method, without compromising the correctness of legitimate decryption, selectively degrades the accuracy of the inequality constraints extracted by the attacker from the side-channel leakage.

[0031] As one implementation method, the parameter of the central binomial distribution can preferably be set to 4. At this time, the upper limit of the absolute value of the injected noise is much smaller than the security budget between the legal decryption boundary and the inherent eigennograph range specified by the ML-KEM algorithm, thus mathematically guaranteeing a zero decryption failure rate. At the same time, due to the randomness of the dynamic noise, the attacker will generate a significant proportion of erroneous constraints in the inequality system derived from the physical features. When the erroneous constraint ratio exceeds the phase transition critical point, the multidimensional objective evaluation scoring function of the attacker's backend greedy solver will fail, and the search path will completely diverge, thus mathematically blocking the possibility of key recovery.

[0032] This step effectively pollutes the quality of the attacker's side-channel data by injecting dynamic random noise without increasing the decryption failure rate of legitimate users. It raises the error constraint ratio of the attacker's inequality system to a level sufficient to disrupt the convergence of the back-end solver, fundamentally blocking the key recovery attack path based on inequality solving and achieving mathematical immunity to chosen-ciphertext side-channel attacks.

[0033] S3, the polynomial coefficient processing stage, relies on a true random number generator to generate a random permutation table, shuffles the processing order of each coefficient, and at the same time randomly adds redundant calculations with power consumption levels completely consistent with the actual calculations according to a pre-set probability.

[0034] Specifically, in the polynomial coefficient processing, this application introduces a randomization mechanism to disrupt the deterministic mapping between physical leakage timing and data indexes, thereby suppressing attackers' time-alignment-based side-channel analysis methods. Specifically, before or during the initiation of the polynomial coefficient cyclic processing, a random permutation table is generated using a true random number generator. This permutation table rearranges the processing order of the polynomial coefficients, transforming the originally sequential coefficient operations into a discrete access mode based on random indices, thus severing the spatial correspondence between specific time sampling points and specific coefficients. Simultaneously, in each coefficient processing iteration, redundant operations with the same power consumption characteristics as the actual operations are randomly inserted with a preset probability. These redundant operations maintain consistency with the actual operations in instruction cycle, bus access logic, and operand expected Hamming weight, but do not actually affect the architecture state. Through the combined effect of the above random permutations and redundant operations, the timing waveforms on different execution trajectories exhibit nonlinear stretching and random jitter, making it impossible for attackers to recover the correct coefficient processing order using traditional trajectory alignment or averaging techniques. As one implementation method, the random permutation table can be generated using the Fisher-Yates algorithm to ensure uniform randomness of the permutations; the insertion probability of redundant operations can preferably be set to 20%, and the redundant operations and the real operations are designed to have the same power consumption on the hardware execution path to eliminate the possibility of stripping based on power envelope characteristics.

[0035] This technique effectively suppresses attackers' side-channel analysis capabilities based on time alignment by disrupting the deterministic association between timing and data indexes. This makes it impossible for attackers to accurately locate specific sampling points and specific polynomial coefficients, even if they can collect physically leaked signals. This significantly increases the difficulty and cost of side-channel attacks and enhances the depth defense capability of hardware protection.

[0036] S4. If the ciphertext is determined to be an attack-type ciphertext, the entire decryption process is stopped immediately, and a random key is output.

[0037] Specifically, when the input ciphertext is detected as malicious, this method immediately terminates the currently executing normal decryption process and outputs a random key as a response. This random key is not calculated using the real private key, but is dynamically generated by a true random number generator or pseudo random number generator built into the hardware circuit. Its value has no mathematical correlation with the legitimate decryption result, thus simultaneously cutting off the attacker's path to obtain valid information through side-channel leakage at both the physical and logical layers. As one implementation, this random key can be a pre-stored fixed random number or a random value generated in real-time by the true random number generator each time it is called. Its length is consistent with the shared key length output by the standard ML-KEM decapsulation, ensuring that subsequent protocol layers cannot distinguish this response from the normal decryption result, achieving implicit rejection. In this way, even if an attacker successfully constructs malicious ciphertext that bypasses input detection, they cannot extract any valid information related to the private key from subsequent physical leaks because the decryption process has been forcibly terminated, and the returned random key does not contain any intermediate calculation results that depend on the key.

[0038] The beneficial effect of this step is that by forcibly terminating the decryption process and returning a random key, the possibility of attackers triggering physical leakage of the key using malicious ciphertext is fundamentally eliminated. This prevents any form of side-channel attack from being blocked before it enters the core computing stage, thus building the last line of defense in the input domain and ensuring that even if there are attack variants that are not covered by the preceding detection module, the system can still maintain absolute protection of the private key.

[0039] Example 2 This application provides a cross-layer collaborative multi-dimensional hybrid-shield hardware protection architecture. Its core idea is to utilize the fault tolerance space (noise budget) of the ML-KEM algorithm itself to pollute the quality of the data collected by the attacker, filling the attacker's inequality system with erroneous constraints, thereby disrupting the convergence conditions of the backend solver. This application mainly includes the following three core collaborative protection strategies: S101. Rotation-Invariant Frequency Domain Algebraic Anomaly Detection Architecture (AAD): Targeting attackers exploiting public keys or its negative ring shift variant The strategy of "masking" malicious low-entropy ciphertext requires 256 brute-force searches using traditional time-domain Euclidean distance matching, resulting in a time complexity of up to [insert time complexity here]. .

[0040] This application introduces the convolution theorem to achieve fast cross-correlation detection in the frequency domain of number theory transform (NTT): utilizing the existing NTT accelerator in the hardware circuit, the input ciphertext polynomial is calculated separately. u and pre-stored public key polynomial aThe frequency domain representation is calculated using dot product and conjugate operations to obtain the cross-correlation spectrum, and finally restored to the time domain using the inverse transform (INTT). Since the normal ciphertext is weakly correlated with the public key, its spectrum is close to the white noise floor, while the attack ciphertext containing the rotation mask will inevitably appear at the corresponding shift index. k This generates extremely high energy spikes. This application successfully reduces the algorithm complexity from... Reduce to Without introducing large-area multipliers, it can intercept all rotation spoofing attacks 100% in a single calculation. Once an anomaly is detected, it immediately terminates execution and triggers an implicit rejection to return a random key.

[0041] The specific steps are as follows: S1011, at the data input end, to prevent attackers from exploiting public keys. or its negative ring shift variant (in The application abandons the traditional time-domain large-overhead Euclidean distance search and adopts a frequency domain cross-correlation detection algorithm, which superimposes the cyclic shift position of the polynomial coefficients onto the low-entropy malicious ciphertext to evade time-domain entropy detection.

[0042] The S1012 directly reuses the existing Number Theory Transform (NTT) hardware accelerator in the ML-KEM core, enabling parallel computation of the input ciphertext polynomial on a single computation path. u Frequency domain representation And read the pre-calculated pre-stored public key frequency domain representation from memory. .

[0043] S1013, Frequency Domain Conjugate Dot Multiplication: Fast calculation of the cross-correlation spectrum of two components in the frequency domain.

[0044] in This represents the dot product. This indicates a conjugate operation.

[0045] S1014, Fast Inverse Transform Restoration: Using the inverse number theory transform accelerator, the cross-correlation spectrum is restored to the time domain:

[0046] Where the polynomial coefficients It can directly map the input ciphertext and public key at different rotation angles. Using algebraic similarity, this algorithm successfully reduces the complexity of full-angle search from... Reduce to .

[0047] S1015, Peak Decision Logic: Calculate the maximum absolute value of the temporal similarity vector. Compared with the mean of background noise The ratio of these values ​​yields the feature determination statistic.

[0048] S1016, Set anomaly detection threshold ( (The standard deviation of the environmental Gaussian noise floor). If If this is detected, it is determined to be a malicious structured spoofing attack. The circuit will be forcibly interrupted and an implicit rejection mechanism will be triggered, immediately returning a meaningless random fake key to the subsequent stage, thus cutting off the path of key-dependent physical leakage at the source. If the data is compliant, it will be considered ciphertext and allowed to proceed to the subsequent decryption process.

[0049] S102. Dynamic Noise Injection Mechanism (DNI) Based on Central Binomial Distribution: The powerful convergence capability of the attacker's backend greedy solver is highly dependent on the accuracy (signal-to-noise ratio) of the input inequality system. This application utilizes the ML-KEM algorithm to decrypt the maximum allowable noise boundary (approximately...). ), minus the effective range of the algorithm's inherent intrinsic noise (by The rule constraint is approximately ), resulting in a security budget of approximately 595.

[0050] In the polynomial subtraction loop stage of the core decryption process, after the sensitive private key operation occurs and before the final information compression, this application dynamically introduces a circuit that follows a central binomial distribution. (Preferred parameters) = 4) dynamic random noise The noise is dynamically refreshed by the system's TRNG during each decryption call, ensuring that even with the same ciphertext, the physical leakage changes over time, completely negating trajectory averaging noise reduction. Mathematically, the maximum absolute value of the injected CBD noise is 4, far less than the budget of 595, thus the system's decryption failure rate (DFR) is strictly 0, not compromising the correctness of legitimate decryption. However, this noise can cause attackers to generate approximately 38% of the incorrect constraints in the inequality system derived from the Hamming weights. When the incorrect constraint ratio crosses the phase transition critical point (25%~30%), the greedy solver's scoring function will fail and get trapped in local extrema, the search path will completely diverge, and thus mathematically blocking the possibility of key recovery.

[0051] The specific steps are as follows: S1021, In response to the side-channel leakage of unstructured legitimate ciphertext that has passed AAD detection, this application does not attempt to completely eliminate physical leakage, but instead adopts a "physical data pollution" strategy, which uses the mathematical tolerance space (NoiseBudget) of the algorithm itself to selectively degrade the accuracy of the inequality constraints collected by the attacker.

[0052] S1022, Fault-Tolerant Security Budget: The legal decryption boundary of ML-KEM as defined in the standard specification is that the absolute value of the coefficients of the full polynomial is strictly less than 1 / 2. Inherent noise generated by the ML-KEM algorithm The standard deviation was experimentally determined to be ,according to The probability envelope rule inherently has a boundary range of [-237, 237]. Therefore, the maximum safe budget for defensive noise that this protection scheme can legally allocate and inject is:

[0053] S1023, Dynamic Noise Generation and Precise Positioning Injection: This application injects the original intermediate decryption operations into the core polynomial subtraction logic of the decryption path. The calculation formula was modified to have noise-shielding capabilities:

[0054] Among them, the coefficients of the noisy polynomial Independent sampling from central binomial distribution .

[0055] S1024, Dynamic Refresh Seed Control: Each time the underlying CBD sampler is called, its initialization seed is dynamically refreshed through the physical true random number generator (TRNG) built into the cryptographic chip. This ensures that at the hardware execution level, even when faced with the exact same ciphertext input, the physical leakage characteristics generated during each decapsulation run are in a random variation state on the time axis, completely immunizing the attacker's repeated trajectory averaging denoising technique.

[0056] S1025, Optimization of parameter selection and proof of phase transition divergence: Optimal setting of central binomial distribution parameters Noise is injected at this time. The absolute value of is capped at 4, far less than the redundancy security boundary of 595, thus mathematically guaranteeing a zero decryption failure rate for legitimate users and perfectly compatibility with NIST compliance tests. However, due to Possessing unknown randomness, attackers can generate up to 38% erroneous constraints in inequality systems derived from physical characteristics. According to constraint theory, once the proportion of erroneous constraints in a linear inequality system exceeds the critical point of 25% to 30%, the multidimensional objective evaluation scoring function of the greedy search solver will completely fail, and the system will instantly freeze. The proximity caused the attacker's algebraic solution algorithm to become completely trapped in local pseudo-extreme points and unable to converge.

[0057] S103. Combined with a double true random temporal fuzzy reordering device (TO): Attackers need to perform time-domain localization by comparing specific time sampling points acquired by the oscilloscope with specific polynomial coefficient indices. This application introduces fine-grained temporal ambiguity techniques in the underlying computational control flow: Based on the classic Fisher-Yates shuffle algorithm, a true random number generator is used to dynamically generate a random permutation table within the inner loop of the polynomial computation, completely shuffling the polynomial coefficients. The logical processing order; in the coefficient calculation path, with a certain probability (preferred) This design dynamically inserts redundant operations, allowing them to operate on free registers without altering the valid architectural state. It ensures that the execution cycle and expected Hamming weight of the redundant operations are completely consistent with the actual operations, achieving an equal-power hardware design.

[0058] By jointly suppressing out-of-order and redundant operations, the time axis exhibits nonlinear stretching and distortion between different trajectories, rendering traditional trajectory alignment and averaging algorithms completely ineffective and masking the effective side-channel signal in the alignment error noise.

[0059] The specific steps are as follows: S1031, In order to prevent attackers from accurately identifying, aligning and locating specific physical leakage sensitive points corresponding to different polynomial coefficients in the time domain, this application sets a fine-grained time domain obfuscator on the underlying computing control circuit.

[0060] S1032, Spatial Index Shuffling: In polynomial computation Before the coefficient subtraction loop starts, the circuit calls a true random number generator to generate random permutation factors and runs the classic Fisher-Yates out-of-order algorithm to generate a completely uniformly distributed random permutation mapping table. This changes the original polynomial logic iteration order from sequential execution to a discrete out-of-order processing mode based on random index pointers, severing the spatial correspondence between physical time points and data polynomial coefficients.

[0061] S1033, Nonlinear stretching of the time axis: In each out-of-order iteration, the time-series fuzzer uses a probability control bit generated by a true random number generator, with preset probability parameters. Dynamically and randomly interleaving redundant clock operations.

[0062] S1034, Equal Power Hardware Alignment: The design ensures that the inserted redundant operation execution path has the exact same number of instruction cycles, the same bus access logic, and the same operand expected Hamming weight (operating in idle registers, without changing the architecture state value) as the actual decryption computation path. This ensures that attackers cannot strip the redundant operation clock through simple power differentials or envelope features. Dynamically inserted redundant operation clocks cause severe and irreversible nonlinear distortions (random jitter) to the time-domain waveform, making it impossible for attackers to find the correct coefficient alignment anchor point even when using complex elastic alignment algorithms (such as dynamic time warping algorithms).

[0063] Synergistic Defense Effect: The three modules of this application are progressively layered and mutually protective: AAD forces attackers to use only unstructured compliant ciphertext, which has greater intrinsic noise; the nonlinear trajectory misalignment caused by TO protects the dynamic noise injected by DNI from being eliminated by attackers through infinite averaging; and the DNI noise smooths the power consumption characteristics, making it impossible for attackers to use elastic alignment algorithms to find feature anchors to restore out-of-order logic. Ultimately, this gives the hardware chip extremely high security depth and substantial immunity against chosen-ciphertext attacks.

[0064] In summary, this application discloses a hybrid-shield protection scheme against side-channel attacks on hardware circuits of the post-quantum cryptography standard ML-KEM, suitable for resource-constrained embedded chip hardware circuit implementations. This application abandons the high-overhead full-masking scheme, and its core aim is to fundamentally block the convergence of the attacker's backend greedy solver by compromising the quality of physically leaked side-channel data. This scheme constructs a defense-in-depth defense in three-dimensional space: In the input domain, it proposes an algebraic anomaly detector (AAD) based on rotation invariance, reusing the built-in NTT hardware to calculate the cross-correlation spectrum of the input ciphertext and public key in the frequency domain, quickly intercepting highly structured malicious ciphertexts with 100% accuracy; In the leakage domain, it proposes a dynamic noise injection (DNI) strategy, utilizing the decryption fault tolerance margin of the ML-KEM algorithm itself, injecting dynamic random noise following a central binomial distribution (CBD) into the polynomial subtraction core, increasing the "error constraint ratio" in the attacker's inequality system to 38%, mathematically forcing the greedy solver to diverge; In the time domain, it combines fine-grained Fisher-Yates dynamic scrambling based on TRNG with a time fuzzer (TO) inserted with 20% dummy clock cycles, breaking the mapping between temporal physical sampling points and data indices. Tests on the Artix-7 FPGA platform show that this application increases the number of power traces required for a successful attack from 325 to over 100,000, achieving computational immunity. Compared to the first-order masking scheme, it only introduces 17.9% logic resource overhead and 23.2% execution latency, achieving an excellent balance between secure deployment and hardware efficiency.

[0065] Example 3 In yet another embodiment, this application provides an ML-KEM decapsulation side-channel protection system, comprising: an ML-KEM decryption kernel, a frequency domain algebraic anomaly detection module (AAD), a dynamic noise injection module (DNI), a time fuzzy generator (TO), a physical true random number generator (TRNG), and a timing control module; wherein, The ML-KEM decryption kernel integrates a number theory transform NTT accelerator, an inverse number theory transform INTT accelerator, and a polynomial subtraction operation core, which are used to perform the basic operations of ML-KEM standard decapsulation. The frequency domain algebraic anomaly detection module (AAD) is configured at the system data input end. It uses the NTT accelerator and the INTT accelerator to complete the frequency domain cross-correlation operation, calculates the cross-correlation spectrum between the input ciphertext polynomial and the pre-stored public key polynomial, solves the ratio of the peak value of the spectrum to the mean value of the background noise and compares it with a preset threshold to identify the ciphertext of the rotation spoofing attack based on the public key cyclic shift. The timing control module is interconnected with the frequency domain algebra anomaly detection module (AAD). When AAD determines that the input ciphertext is an attack-type ciphertext, the timing control module cuts off the subsequent operation path, terminates the entire decryption process, and controls the system to output a random key. The Dynamic Noise Injection Module (DNI) is deployed inside the polynomial subtraction operation core and connected to the TRNG. After the AAD determines that the text is compliant and encrypted, the TRNG refreshes the noise sampling seed in real time, generates dynamic random noise that follows a central binomial distribution, and superimposes it onto the intermediate calculation result of the polynomial subtraction. The time fuzzer TO is connected to TRNG and timing control module respectively. During the polynomial coefficient cyclic processing stage, TRNG is called to run Fisher-Yates scrambling algorithm to generate random permutation table to shuffle the hardware processing order of polynomial coefficients. At the same time, timing control module inserts redundant dummy clock operations with power consumption, running cycle and actual operation completely equivalent according to preset probability to realize time domain trajectory confusion.

[0066] An embodiment of this application provides an ML-KEM decapsulation side-channel protection system that utilizes the fault tolerance space (noise budget) of the ML-KEM algorithm itself to pollute the quality of the data collected by the attacker, making the attacker's inequality system full of erroneous constraints, thereby disrupting the convergence conditions of the back-end solver.

[0067] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0068] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A side-channel protection method for ML-KEM decapsulation, characterized in that, include: Obtain the cross-correlation spectrum of the input ciphertext and the pre-stored public key in the frequency domain cross-correlation detection, and compare the ratio of the peak value of the spectrum to the mean value of the background noise with a preset threshold to determine whether the input ciphertext is a ciphertext for a rotation spoofing attack. If the text is determined to be normal and compliant encrypted, dynamic random noise that conforms to the central binomial distribution is added to the polynomial subtraction calculation stage. In the polynomial coefficient processing stage, a random permutation table is generated by a true random number generator to shuffle the processing order of each coefficient. At the same time, redundant calculations with power consumption levels completely consistent with the actual calculations are randomly added according to a pre-set probability. If the ciphertext is determined to be malicious, the entire decryption process is stopped immediately, and a random key is output.

2. The method as described in claim 1, characterized in that, The step of obtaining the cross-correlation spectrum between the input ciphertext and the pre-stored public key in the frequency domain cross-correlation detection, and comparing the ratio of the peak value of the spectrum to the mean of the background noise with a preset threshold to determine whether the input ciphertext is a rotation spoofing attack ciphertext, includes: The number theory transformation hardware acceleration unit built into the ML-KEM module is reused to synchronously calculate the frequency domain data corresponding to the input ciphertext polynomial, while reading the pre-saved public key frequency domain data from the storage unit. In the frequency domain, pointwise multiplication and conjugate operations of the two sets of data are performed to obtain cross-correlation spectrum data. The inverse number theory transform hardware unit is then called to convert the cross-correlation spectrum into time domain data. Extract the maximum absolute value among all temporal similarity values, and then calculate the ratio of this value to the average absolute value of all temporal data, as a feature statistic for determining attack behavior; The threshold for anomaly detection is set at five times three standard deviations of the inherent Gaussian noise in the environment. When the feature statistics exceed this threshold, it is determined that there is a malicious structured spoofing attack. If the feature statistics do not exceed this threshold, it is determined to be compliant encrypted text.

3. The method as described in claim 2, characterized in that, Extract the maximum absolute value among all temporal similarity values, and then calculate the ratio of this value to the average absolute value of all temporal data. This ratio is used as a feature statistic to determine the attack behavior. Each coefficient of temporal similarity can directly reflect the algebraic similarity between the input ciphertext and the public key under various rotation angles.

4. The method as described in claim 1, characterized in that, If the text is determined to be normal and compliant ciphertext, dynamic random noise conforming to the central binomial distribution is added to the polynomial subtraction calculation stage, including: The core polynomial subtraction operation logic of the decryption core was modified, and defensive noise was superimposed on the original intermediate calculation results of the decryption before the modular operation was completed. All defense noise values ​​are generated independently by sampling according to the central binomial distribution law; Whenever the noise sampling process is initiated, the initial seed required for sampling is regenerated by the physical true random number generator built into the cryptographic chip.

5. The method as described in claim 4, characterized in that, All defense noise values ​​are independently sampled and generated according to the central binomial distribution, with fixed parameters configured for the central binomial distribution. The maximum absolute value of a single defense noise value generated in this way is 4.

6. The method as described in claim 1, characterized in that, In the polynomial coefficient processing stage, a random permutation table is generated using a true random number generator to shuffle the processing order of each coefficient. Simultaneously, redundant calculations with power consumption levels completely consistent with the actual calculations are randomly added according to a pre-set probability, including: Before the polynomial coefficient subtraction loop starts, the circuit calls a true random number generator to generate random permutation factors, runs the Fisher-Yates out-of-order algorithm, generates a completely uniformly distributed random permutation mapping table, and changes the original polynomial logic iteration order from sequential execution to a discrete out-of-order processing mode based on random index pointers. In each out-of-order iteration, the timing fuzzer dynamically and randomly interleaves redundant clock operations based on the probability control bits generated by the true random number generator with preset probability parameters.

7. The method as described in claim 6, characterized in that, In the operation of dynamically and randomly interleaving redundant clocks with preset probability parameters, the inserted redundant operation execution path has the same number of instruction cycles, the same bus access logic, and the same operand expected Hamming weight as the real decryption calculation path, and operates in an idle register without changing the system architecture state value.

8. The method as described in claim 1, characterized in that, If the ciphertext is determined to be an attack-type ciphertext, the entire decryption process will be stopped immediately, and a random key will be output to the outside. This includes: the circuit will execute a forced interruption and trigger an implicit rejection mechanism, immediately returning a meaningless random pseudo-key to the next stage.

9. An ML-KEM decapsulation side-channel protection system, characterized in that, This includes an ML-KEM decryption kernel, a frequency domain algebraic anomaly detection module (AAD), a dynamic noise injection module (DNI), a temporal fuzzer (TO), a physical true random number generator (TRNG), and a timing control module; among which, The ML-KEM decryption kernel integrates a number theory transform NTT accelerator, an inverse number theory transform INTT accelerator, and a polynomial subtraction operation core, which are used to perform the basic operations of ML-KEM standard decapsulation. The frequency domain algebraic anomaly detection module (AAD) is configured at the system data input end. It uses the NTT accelerator and the INTT accelerator to complete the frequency domain cross-correlation operation, calculates the cross-correlation spectrum between the input ciphertext polynomial and the pre-stored public key polynomial, solves the ratio of the peak value of the spectrum to the mean value of the background noise and compares it with a preset threshold to identify the ciphertext of the rotation spoofing attack based on the public key cyclic shift. The timing control module is interconnected with the frequency domain algebra anomaly detection module (AAD). When AAD determines that the input ciphertext is an attack-type ciphertext, the timing control module cuts off the subsequent operation path, terminates the entire decryption process, and controls the system to output a random key. The Dynamic Noise Injection Module (DNI) is deployed inside the polynomial subtraction operation core and connected to the TRNG. After the AAD determines that the text is compliant and encrypted, the TRNG refreshes the noise sampling seed in real time, generates dynamic random noise that follows a central binomial distribution, and superimposes it onto the intermediate calculation result of the polynomial subtraction. The time fuzzer TO is connected to TRNG and timing control module respectively. During the polynomial coefficient cyclic processing stage, TRNG is called to run Fisher-Yates scrambling algorithm to generate random permutation table to shuffle the hardware processing order of polynomial coefficients. At the same time, timing control module inserts redundant dummy clock operations with power consumption, running cycle and actual operation completely equivalent according to preset probability to realize time domain trajectory confusion.

Images