Security evaluation apparatus, security evaluation method, and program

Abstract

To provide a technology capable of evaluating side channel attack resistance of a device with high accuracy.SOLUTION: A security evaluation apparatus includes: an input unit that inputs learning data represented by a pair of a plaintext at a j-th byte and side channel information on the j-th byte acquired from a first device; a latent vector calculation unit that calculates a latent vector for the j-th byte by using a first model and the side channel information on the j-th byte; a probability vector calculation unit that calculates a probability vector for the plaintext at the j-th byte by using a second model for the j-th byte and the latent vector for the j-th byte; a learning unit that learns a parameter of the first model and a parameter of the second model for the j-th byte by using an error between the plaintext at the j-th byte and the probability vector for the plaintext at the j-th byte; and a prediction unit that predicts a private key of a second device by using evaluation data represented by a pair of a plaintext and side channel information on the j-th byte acquired from the second device, the learned first model, and the learned second model for the j-th byte.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to a safety evaluation device, a safety evaluation method, and a program. [Background technology]

[0002] A side channel attack is known as a method for non-destructively stealing confidential information from devices such as LSI chips (for example, Non-Patent Document 1). In a side channel attack, information such as power consumption and electromagnetic waves (hereinafter also referred to as "side channel information") that can be obtained from the LSI chip to be attacked is used to predict the processing being performed in the chip. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Mine Ueno, Rikuma Tanaka, San Ito, and Naofumi Homma, "A Study on Non-Profiling Deep Learning Side-Channel Attacks Using Partial Key Difference Guessing," In SCIS, 2023. Summary of the Invention [Problem to be solved by the invention]

[0004] However, the conventional method described in Non-Patent Document 1 and the like requires a large amount of side channel information to steal secret information. In general, the smaller the amount of side channel information required to steal secret information, the more powerful the side channel attack is, and by actually applying such a powerful side channel attack to a device such as an LSI chip, it becomes possible to evaluate the side channel attack resistance of the device with high accuracy.

[0005] The present disclosure has been made in consideration of the above points, and aims to provide a technique that can evaluate the side-channel attack resistance of a device with high accuracy. [Means for solving the problem]

[0006] A safety evaluation device according to an aspect of the present disclosure is a safety evaluation device capable of evaluating resistance of a device to a side channel attack, the safety evaluation device including an input unit that inputs learning data represented by a pair of a j-th byte of plaintext and a j-th byte of side channel information acquired from a first device when the j-th byte of plaintext is input, where 1≦j≦B (where B is a predetermined integer of 1 or more), a first model for embedding side channel information in a latent vector space, a latent vector calculation unit that uses the j-th byte of side channel information to calculate a latent vector corresponding to the j-th byte of side channel information, and a j-th model for calculating a probability vector of a value taken by the j-th byte of plaintext from the latent vector. the jth byte of plaintext using a probability vector calculation unit that calculates a probability vector of a value taken by the jth byte of plaintext using a latent vector corresponding to the jth byte of side channel information; a learning unit that learns parameters of the first model and parameters of the jth byte of a second model using an error between the jth byte of plaintext and the probability vector of a value taken by the jth byte of plaintext; and a prediction unit that predicts a secret key to be used for encryption on the second device using evaluation data represented by a set of the jth byte of plaintext and the jth byte of side channel information acquired from the second device when the jth byte of plaintext is input, the learned first model, and the learned second model for the jth byte. Effect of the Invention

[0007] A technology is provided that can evaluate the side-channel attack resistance of a device with high accuracy. [Brief description of the drawings]

[0008] [Figure 1] FIG. 2 is a diagram illustrating an example of a hardware configuration of the safety evaluation device according to the present embodiment. [Diagram 2] FIG. 2 is a diagram illustrating an example of a functional configuration of a safety evaluation device during learning. [Diagram 3] 10 is a flowchart illustrating an example of a learning process according to the present embodiment. [Figure 4] FIG. 2 is a diagram illustrating an example of a functional configuration of a safety evaluation device at the time of inference. [Diagram 5] 10 is a flowchart illustrating an example of a secret key prediction process according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, one embodiment of the present invention will be described.

[0010] <Security evaluation against side-channel attacks> A side channel attack is a method of non-destructively stealing secret information from a device such as an LSI chip. For example, Non-Patent Document 1 describes a method of constructing a deep learning model in which side channel information is input and the signal value inside the chip is output, and then using this deep learning model and side channel information obtained from a cryptographic module such as AES to steal the private key of the cryptographic module. Side channel information is, for example, information such as power consumption and electromagnetic waves that can be obtained from a device such as an LSI chip. Note that side channel information such as power consumption and electromagnetic waves is expressed as a waveform, so the side channel information may be called a "side channel waveform" or the like.

[0011] In a side channel attack, it is difficult to steal secret information with a small amount of side channel information, and a large amount of side channel information is generally required to steal secret information. On the other hand, whether a certain side channel attack is powerful or not is determined by the number of pieces of side channel information required to steal secret information. In general, the fewer the number of pieces of side channel information required to steal secret information, the more powerful the side channel attack is. In addition, the resistance of a device such as an LSI chip to a side channel attack is evaluated by actually applying a side channel attack to the device. Therefore, the proposal of a more powerful side channel attack will lead to a more accurate evaluation of the resistance to a side channel attack.

[0012] Hereinafter, a case where a private key is stolen from an AES encryption module by a side channel attack using deep learning as described in Non-Patent Document 1 and the like will be considered. In 128-bit AES, the input plaintext and private key are composed of 16 bytes. In AES, AddRoundKey and SubBytes are applied to each byte first. Therefore, 16 pieces of power information (e.g., power consumption, etc.) related to each plaintext and private key are leaked as side channel information obtained by one encryption. In the method described in Non-Patent Document 1, a deep learning model is constructed using only one piece of side channel information out of these 16 pieces of power information. For this reason, a lot of side channel information is required to obtain the private key. On the other hand, by utilizing all of these 16 pieces of side channel information in constructing a deep learning model, it is expected that a more efficient side channel attack (i.e., a more powerful side channel attack) can be realized.

[0013] Therefore, hereinafter, assuming an AES cryptographic module as a device, a security evaluation device 10 that can realize a more powerful side channel attack to steal a private key used in encryption processing by utilizing all 16 pieces of side channel information in constructing a deep learning model will be described. By actually performing a side channel attack on a cryptographic module to be security evaluated using this security evaluation device 10, it becomes possible to highly accurately evaluate the resistance (security) of the cryptographic module against side channel attacks.

[0014] Here, the security evaluation device 10 according to this embodiment includes a learning time when a deep learning model is learned and an inference time when inference is performed using a trained deep learning model. In the security evaluation device 10 according to this embodiment, a deep learning model for predicting an AES private key is learned during learning, and then the private key is predicted from side channel information using the trained deep learning model during inference. Since the inference time is a phase in which a private key is actually stolen from a cryptographic module by a side channel attack, it may be called an "attack time" or an "attack phase", etc. On the other hand, the learning time may be called a "learning phase", etc.

[0015] A deep learning model is a function or algorithm that has learnable parameters (hereinafter also referred to as "model parameters"), such as a neural network. A deep learning model may be called, for example, a "machine learning model" or simply a "model."

[0016] <Notation and definition> The notations and definitions used in this embodiment will be described below.

[0017] For a vector x, the i-th component (i-th element) is represented as x[i]. The j-th byte of the AES secret key is represented as k (j) ∈GF(2 8 ) where GF(2 8 ) is a Galois extension field.

[0018] In addition, the j-th byte of plaintext input to AES for the i-th time (where i is a natural number) is expressed as t i (j) ∈GF(2 8 ) and the plaintext t i (j) Let the corresponding intermediate value (output of SubBytes) be:

[0019]

number

[0020] Also, the intermediate value z i (j) The side channel information corresponding to the n-dimensional real vector l i (j) ∈R n This side channel information l i(j) For example, the plain text t i (j) to the intermediate value z i (j) The power consumption is calculated by the side channel information l i (j) represents a series of power consumption is just one example, and is not limited to power consumption, and may be power information other than power consumption (e.g., voltage, current, etc.), information related to electromagnetic waves (e.g., radio wave intensity, etc.), or other information (e.g., audio such as noise).

[0021] <Hardware Configuration Example of Safety Evaluation Device 10> An example of the hardware configuration of the safety evaluation device 10 according to this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the hardware configuration of the safety evaluation device 10 according to this embodiment.

[0022] 1, a safety evaluation device 10 according to this embodiment includes an input device 101, a display device 102, an external I / F 103, a communication I / F 104, a RAM (Random Access Memory) 105, a ROM (Read Only Memory) 106, an auxiliary storage device 107, and a processor 108. Each of these pieces of hardware is connected to each other via a bus 109 so as to be able to communicate with each other.

[0023] The input device 101 is, for example, a keyboard, a mouse, a touch panel, a physical button, etc. The display device 102 is, for example, a display, a display panel, etc. Note that the safety evaluation device 10 does not necessarily have to include at least one of the input device 101 and the display device 102, for example.

[0024] The external I / F 103 is an interface with an external device such as a recording medium 103a. Examples of the recording medium 103a include a CD (Compact Disc), a DVD (Digital Versatile Disk), an SD memory card (Secure Digital memory card), and a USB (Universal Serial Bus) memory card.

[0025] The communication I / F 104 is an interface for connecting the safety evaluation device 10 to a communication network. The RAM 105 is a volatile semiconductor memory (storage device) that temporarily stores programs and data. The ROM 106 is a non-volatile semiconductor memory (storage device) that can store programs and data even when the power is turned off. The auxiliary storage device 107 is a non-volatile storage device such as a hard disk drive (HDD), a solid state drive (SSD), or a flash memory. The processor 108 is various types of arithmetic devices such as a central processing unit (CPU) or a graphic processing unit (GPU).

[0026] 1 is merely an example, and the hardware configuration of the safety evaluation device 10 is not limited thereto. For example, the safety evaluation device 10 may have multiple auxiliary storage devices 107 and multiple processors 108, may not have some of the hardware shown in the figure, or may have various hardware other than the hardware shown in the figure.

[0027] During study The security evaluation device 10 during training will be described below. The security evaluation device 10 during training has a training data set D={d i (j) :=(t i (j) ,l i (j))|1≦j≦16,1≦i≦N} is given, where d i (j) is the learning data, and N is the number of plaintexts input to AES. Note that the security evaluation device 10 during learning may be called, for example, a "learning device."

[0028] The model to be learned by the safety evaluation device 10 during learning is g = g(·;θ), f j =f j ( ;φ (j) )(1≦j≦16). g:R n →R m is a model such as a neural network that takes side channel information as input and outputs a latent vector (in other words, a model for embedding side channel information in a latent vector space), and θ is its model parameter. j :R m →R 256 is a model such as a neural network that takes the latent vector corresponding to the jth byte as input and outputs a probability vector of the plaintext, and φ (j) is the model parameter. Here, m is the dimension of the latent vector space. A probability vector is a vector whose elements are all between 0 and 1, and whose sum is 1.

[0029] <Example of Functional Configuration of Safety Evaluation Device 10 During Learning> An example of the functional configuration of the safety evaluation device 10 during learning will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the functional configuration of the safety evaluation device 10 during learning.

[0030] As shown in Fig. 2, the safety evaluation device 10 during learning includes an input unit 201, a latent vector calculation unit 202, a probability vector calculation unit 203, and a learning unit 204. Each of these units is realized, for example, by a process in which one or more programs installed in the safety evaluation device 10 are executed by the processor 108 or the like. Furthermore, the safety evaluation device 10 during learning includes a model parameter storage unit 205. The model parameter storage unit 205 is realized, for example, by a storage area of ​​the auxiliary storage device 107 or the like. Note that the model parameter storage unit 205 may be realized, for example, by a storage area of ​​a storage device or the like connected to the safety evaluation device 10 via a communication network.

[0031] The input unit 201 inputs the learning dataset D given to the safety evaluation device 10.

[0032] The latent vector calculation unit 202 uses the learning data d i (j) Side channel information l contained in ∈D i (j) (That is, the j-th byte of plaintext t i (j) to the intermediate value z i (j) Using the side-channel information obtained when calculating i (j) =g(l i (j) ;θ) is calculated.

[0033] The probability vector calculation unit 203 calculates the latent vector h i (j) Using this, we obtain the probability vector q i (j) =f j (h i (j) ;φ (j) ) is calculated. i (j) is plain text i (j)It represents the probability of predicting the value of q i (j) Each element of is the plaintext t i (j) represents the probability that the value of the element is the same as the probability vector q i (j) The kth (where 1≦k≦256) element of i (j) It represents the probability that the value of t is k-1. i (j) Since is a single byte, it can be any value between 0 and 255. i (j) Note that, for example, can be expressed as a 256-dimensional one-hot vector in which only some elements are 1 and the other elements are 0.

[0034] The learning unit 204 uses the learning data d i (j) ∈D contains the plaintext t i (j) and the probability vector q calculated by the probability vector calculation unit 203. i (j) After calculating the error with (j) (1≦j≦16). As an error function for calculating the error, for example, cross entropy or square error may be used. In addition, the model parameters θ and φ (j) For updating (1≦j≦16), a known optimization method such as a gradient descent method using an error backpropagation method may be used.

[0035] The model parameter storage unit 205 stores the model parameters θ and φ (j) Store (1≦j≦16).

[0036] <Learning process> The learning process according to this embodiment will be described below with reference to Fig. 3. Fig. 3 is a flowchart showing an example of the learning process according to this embodiment.

[0037] First, the input unit 201 inputs a given learning data set D (step S101).

[0038] Next, the learning unit 204 learns the model parameters θ and φ (j) (1≦j≦16) (step S102). Note that the learning unit 204 initializes the model parameters θ and φ by using, for example, a known initialization method. (j) Simply initialize (1≦j≦16) to an appropriate random number.

[0039] Next, the latent vector calculation unit 202 uses the learning data d i (j) Side channel information l contained in ∈D i (j) Using the latent vector h i (j) =g(l i (j) ;θ) is calculated (step S103).

[0040] Next, the probability vector calculation unit 203 calculates the latent vector h i (j) Using this, we obtain the probability vector q i (j) =f j (h i (j) ;φ (j) ) is calculated (step S104).

[0041] Next, the learning unit 204 uses the learning data d i (j) ∈D contains the plaintext t i (j) and the probability vector q calculated in step S104 above. i (j) Error E i (j) (Step S105). For example, the learning unit 204 calculates the plain text t i (j) A 256-dimensional one-hot vector representing the probability vector q i (j) Error Ei (j) can be calculated using an error function such as cross entropy or square error.

[0042] Next, the learning unit 204 calculates the error E i (j) Using the above, the model parameters θ and φ stored in the model parameter storage unit 205 are calculated. (j) For example, the learning unit 204 updates the model parameters θ and φ by a known optimization method such as a gradient descent method using an error backpropagation method. (j) Just update it.

[0043] Next, the learning unit 204 determines whether or not to end the learning process (step S107). For example, the learning unit 204 may determine to end the learning process if a predetermined end condition is satisfied, and may determine not to end the learning process if a predetermined end condition is not satisfied. The end condition may be, for example, (j) (1≦j≦16) has converged.

[0044] If it is determined in step S107 that the learning process should not be ended, the learning unit 204 returns to step S103. As a result, steps S103 to S106 are repeatedly executed until a predetermined end condition is satisfied.

[0045] On the other hand, if it is determined in step S107 that the learning process is to be ended, the learning unit 204 ends the learning process. (j) (1≦j≦16) is obtained.

[0046] In the above learning process, online learning is assumed, but this is only an example, and batch learning or mini-batch learning may be used. In addition, when online learning or mini-batch learning is used, the learning data d is probabilistically generated, for example, by a stochastic gradient descent method or the like. i (j) A technique for sampling ∈D may be used.

[0047] ·At the time of inference The following describes the security evaluation device 10 during inference (i.e., when evaluating the side-channel attack resistance of a cryptographic module by actually performing a side-channel attack on the cryptographic module and attempting to steal the private key). The security evaluation device 10 during inference receives an attack data set D'={d i (j) :=(t i (j) ,l i (j) )|1≦j≦16,1≦i≦N'} is given, where d i (j) is the attack data, and N' is the number of plaintexts input to AES. The attack data set D' may be D'=D or D'≠D. Note that the attack data set D' and the attack data d i (j) are used to evaluate the side-channel attack resistance of cryptographic modules, so they are called "Evaluation Data Set D'" and "Evaluation Data d i (j) " etc.

[0048] The model parameters θ and f j =f j ( ;φ (j) )(1≦j≦16) model parameter φ (j) are assumed to have been trained, and the trained model parameters θ and φ are assumed to have been trained, respectively. (j) He said.

[0049] <Example of Functional Configuration of Safety Evaluation Device 10 During Inference> An example of the functional configuration of the safety evaluation device 10 at the time of inference will be described with reference to Fig. 4. Fig. 4 is a diagram showing an example of the functional configuration of the safety evaluation device 10 at the time of inference.

[0050] As shown in FIG. 4, the safety evaluation device 10 at the time of inference has an input unit 201, a latent vector calculation unit 202, a probability vector calculation unit 203, a prediction unit 206, and an output unit 207. Each of these units is realized, for example, by a process in which one or more programs installed in the safety evaluation device 10 are executed by the processor 108 or the like. In addition, the safety evaluation device 10 at the time of inference has a model parameter storage unit 205. The model parameter storage unit 205 is realized, for example, by a storage area of ​​the auxiliary storage device 107 or the like. Note that the model parameter storage unit 205 may be realized, for example, by a storage area of ​​a storage device or the like connected to the safety evaluation device 10 via a communication network.

[0051] The input unit 201 inputs the attack data set D′ given to the safety evaluation device 10 .

[0052] The latent vector calculation unit 202 uses the attack data d i (j) Side channel information l included in ∈D' i (j) (That is, the j-th byte of plaintext t i (j) to the intermediate value z i (j) Using the side-channel information obtained when calculating i (j) =g(l i (j) ;θ) is calculated.

[0053] The probability vector calculation unit 203 calculates the latent vector h i (j) Using this, we obtain the probability vector q i (j) =f j (h i (j) ;φ (j) ) is calculated.

[0054] The prediction unit 206 uses the attack data d i (j)∈D' contains the plaintext t i (j) and the probability vector q calculated by the probability vector calculation unit 203. i (j) Using the above, each AES secret key k (j) More specifically, the prediction unit 206 predicts a certain j'th byte of the secret key k (j') and each other private key k (j) A differential key δ that represents the exclusive OR with (j∈{1, ,16}\{j'}) (j) and predict the secret key k (j') By using brute force or other methods, each private key k (j) Calculate (j∈{1, ,16}).

[0055] The output unit 207 outputs each secret key k calculated by the prediction unit 206. (j) to a predetermined output destination. Examples of the output destination include a display device 102 such as a display, an auxiliary storage device 107, other programs, and a terminal connected via a communication network.

[0056] The model parameter storage unit 205 stores the learned model parameters θ and φ (j) Store (1≦j≦16).

[0057] <Private key prediction process> Hereinafter, the private key prediction process according to this embodiment will be described with reference to FIG. 5. FIG. 5 is a flowchart showing an example of the private key prediction process according to this embodiment. The private key prediction process is carried out by using an attack data set D′ obtained from a cryptographic module to be evaluated to obtain a private key k (j) This is the process of predicting the correct private key k (j) A cryptographic module that requires the use of an attack data set D' with a larger N' to obtain C is evaluated as having higher resistance to side channel attacks (i.e., the security of the cryptographic module against side channel attacks is higher).

[0058] First, the input unit 201 inputs a given attack dataset D' (step S201).

[0059] Next, the prediction unit 206 selects j'∈{1, , 16} representing bytes for which the private key is to be obtained by brute force (step S202). Note that the prediction unit 206 may, for example, randomly select j'∈{1, , 16}, or may select a predetermined integer between 1 and 16 as j'.

[0060] Next, the prediction unit 206 initializes the set V to V←{1, . . . , 16}\{j'} (step S203).

[0061] Next, the prediction unit 206 selects j∈V (step S204). Note that the prediction unit 206 may, for example, randomly select j∈V, or may select the first element of V (that is, the element with the smallest value) as j.

[0062] Next, the latent vector calculation unit 202 calculates attack data d i (j) Side channel information l included in ∈D' i (j) Using the latent vector h i (j) =g(l i (j) ;θ) is calculated (step S205).

[0063] Next, the probability vector calculation unit 203 calculates the latent vector h i (j) (i=1, ,N'), the probability vector q of the j-th plaintext inputted in the i-th input i (j) =f j (h i (j) ;φ (j) ) is calculated (step S206).

[0064] Next, the prediction unit 206 uses the attack data d i(j) Plaintext t included in ∈D' i (j) (i=1, ,N′) and the probability vector q calculated in step S206 above. i (j) (i=1, ,N') and the differential key (predicted value) δ (j) =k (j') (+)k (j) is calculated (step S207).

[0065]

number

[0066] Next, the prediction unit 206 determines whether |V|>1 (that is, whether the number of elements of V is greater than 1) (step S208).

[0067] If it is determined in step S208 above that |V|>1, the prediction unit 206 updates the set V to V←V\{j} (step S209) and returns to step S204. As a result, the processes in and after step S204 are executed again using the updated set V.

[0068] On the other hand, if it is not determined in step S208 that |V|>1 (that is, |V|≦1), the prediction unit 206 predicts the j'th byte of the secret key k (j') is calculated by brute force (step S210). (j') Since there are at most 256 possibilities, it can be easily found by brute force.

[0069] Next, the prediction unit 206 uses the secret key k calculated in step S210 above. (j') For each j∈{1, , 16}\{j'}, (j) from the private key k(j) That is, the prediction unit 206 calculates δ for each j∈{1, . . . , 16}\{j'} (step S211). (j) (+)k (j') By using the private key k (j) Calculate.

[0070] Finally, the output unit 207 outputs the secret key k calculated in step S210. (j') and the secret key k calculated in step S211 above. (j) (j∈{1, . . . , 16}\{j'}) to a predetermined output destination (step S212). (j) (j∈{1, ,16}) is output to the specified output destination. This creates the 1st to 16th bytes of the AES secret key k (j) (j∈{1, ,16}).

[0071] <Summary> As described above, the safety evaluation device 10 according to the present embodiment has a machine learning model g that embeds side-channel information in common for all bytes into a latent vector space, and a machine learning model f that obtains a probability vector of the j-th byte of plaintext from the latent vector of the j-th byte of side-channel information. j (1≦j≦16). In addition, the safety evaluation device 10 according to this embodiment trains a trained machine learning model g and a trained machine learning model f for the purpose of evaluating the safety of a cryptographic module (evaluating the resistance to side-channel attacks). j (1≦j≦16) is used to predict the AES secret key from the side channel information of the cryptographic module.

[0072] As a result, compared to the conventional method, it becomes possible to predict the correct secret key of AES with a smaller amount of side channel information (i.e., with an attack data set D' with a smaller N') when evaluating the security of a cryptographic module. Therefore, according to the security evaluation device 10 of this embodiment, a stronger side channel attack can be realized compared to the conventional method, and as a result, it becomes possible to evaluate the resistance to side channel attacks with higher accuracy.

[0073] The security evaluation device 10 according to this embodiment can be applied to block ciphers other than AES (for example, block ciphers having an SPN structure, block ciphers having a Feistel structure using an Sbox) in the same manner. However, in this case, unlike AES, it is not necessarily the case that the block cipher has a 16-byte Sbox, so that an integer of 1 or more predetermined according to the block cipher to which the security evaluation device 10 according to this embodiment is applied is set as B, and the range of integers that j in the above embodiment can take is set as 1≦j≦B.

[0074] The present invention is not limited to the above-described embodiments specifically disclosed, and various modifications, changes, combinations with known technologies, etc. are possible without departing from the scope of the claims. [Explanation of symbols]

[0075] 10 Safety evaluation equipment 101 Input Device 102 Display device 103 External I / F 103a Recording media 104 Communication I / F 105 RAM 106 ROM 107 Auxiliary storage 108 processors 109 Bus 201 Input section 202 Latent Vector Calculation Unit 203 Probability Vector Calculation Unit 204 Learning Department 205 Model parameter storage unit 206 Prediction Department 207 Output section

Claims

1. A security evaluation device capable of evaluating resistance of a device to a side channel attack, comprising: an input unit that inputs learning data represented by a pair of a j-th byte of plaintext and a j-th byte of side-channel information acquired from the first device when the j-th byte of plaintext is input, where 1≦j≦B (where B is a predetermined integer equal to or greater than 1); a latent vector calculation unit that calculates a latent vector corresponding to the j-th byte of side channel information by using a first model for embedding side channel information in a latent vector space and the j-th byte of side channel information; a probability vector calculation unit that calculates a probability vector of a value taken by the j-th byte of plaintext, using a second model of the j-th byte for calculating a probability vector of a value taken by the j-th byte of plaintext from a latent vector and the latent vector corresponding to the j-th byte of side-channel information; a learning unit that learns parameters of the first model and parameters of the second model for the j-th byte by using an error between the j-th byte of plaintext and a probability vector of a value taken by the j-th byte of plaintext; a prediction unit that predicts a secret key used for encryption in the second device, using evaluation data represented by a set of a j-th byte of plaintext and the j-th byte of side channel information acquired from the second device when the j-th byte of plaintext is input, the trained first model, and the trained second model of the j-th byte; A safety evaluation device having the above structure.

2. The prediction unit is Calculate the j'th byte of the private key by brute force; Calculating a latent vector corresponding to the j-th byte of side channel information by the trained first model from the j-th (j∈{1, ..., B}\{j'})-th byte of side channel information acquired from the second device; calculating a probability vector of a value taken by the j-th byte of plaintext using a second model that has been trained on the j-th byte from a latent vector corresponding to the j-th byte of side-channel information; 2. The security evaluation device according to claim 1, further comprising: a differential key between the jth byte of the private key and the j'th byte of the private key, using a jth byte of plaintext and a probability vector of a value taken by the jth byte of the plaintext.

3. The prediction unit is 3. The security evaluation device according to claim 2, wherein the jth byte of the private key is calculated using a difference key between the jth byte of the private key and the j'th byte of the private key, and the j'th byte of the private key.

4. The prediction unit is 4. The security evaluation device according to claim 2 or 3, wherein a 1-byte value that is the minimum negative logarithm of an element value corresponding to a value of an exclusive OR with the j-th byte of plaintext among elements of a probability vector of a value taken by the j-th byte of plaintext is calculated as the j-th byte of the private key.

5. A security evaluation method capable of evaluating resistance of a device to a side channel attack, comprising: an input step of inputting training data represented by a pair of a j-th byte of plaintext and a j-th byte of side-channel information acquired from the first device when the j-th byte of plaintext is input, where 1≦j≦B (where B is a predetermined integer of 1 or more); a latent vector calculation step of calculating a latent vector corresponding to the j-th byte of side channel information by using a first model for embedding side channel information in a latent vector space and the j-th byte of side channel information; a probability vector calculation step of calculating a probability vector of a value taken by the j-th byte of plaintext using a second model of the j-th byte for calculating a probability vector of a value taken by the j-th byte of plaintext from a latent vector and a latent vector corresponding to the j-th byte of side-channel information; a learning procedure for learning parameters of the first model and parameters of the second model for the j-th byte by using an error between the j-th byte of plaintext and a probability vector of a value taken by the j-th byte of plaintext; a prediction step of predicting a secret key to be used for encryption in the second device, using evaluation data represented by a set of a j-th byte of plaintext and the j-th byte of side-channel information acquired from the second device when the j-th byte of plaintext is input, the trained first model, and the trained second model of the j-th byte; A safety evaluation method performed by a computer.

6. A security evaluation method capable of evaluating resistance of a device to a side channel attack, comprising: an input step of inputting training data represented by a pair of a j-th byte of plaintext and a j-th byte of side-channel information acquired from the first device when the j-th byte of plaintext is input, where 1≦j≦B (where B is a predetermined integer of 1 or more); a latent vector calculation step of calculating a latent vector corresponding to the j-th byte of side channel information by using a first model for embedding side channel information in a latent vector space and the j-th byte of side channel information; a probability vector calculation step of calculating a probability vector of a value taken by the j-th byte of plaintext using a second model of the j-th byte for calculating a probability vector of a value taken by the j-th byte of plaintext from a latent vector and a latent vector corresponding to the j-th byte of side-channel information; a learning procedure for learning parameters of the first model and parameters of the second model for the j-th byte by using an error between the j-th byte of plaintext and a probability vector of a value taken by the j-th byte of plaintext; a prediction step of predicting a secret key to be used for encryption in the second device, using evaluation data represented by a set of a j-th byte of plaintext and the j-th byte of side-channel information acquired from the second device when the j-th byte of plaintext is input, the trained first model, and the trained second model of the j-th byte; A program for causing a computer to execute a safety evaluation method including the above.

Images