Learning Identification Device Timing Attack Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional countermeasures against timing attacks on deep learning are inadequate, as they focus on concealing internal parameters or probability information, which does not prevent attacks based on the relationship between input data and processing time. Additionally, existing countermeasures for encryption devices are not directly applicable to deep learning.
Innovation Solution
A learning-and-recognition apparatus is designed with a time control unit that makes the processing time of the learning-and-recognition processing independent of the input data. This is achieved by applying random noise to the input data using a data masking unit and potentially randomizing input or output time points.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If conventional countermeasures (concealing internal parameters or probability information) are applied, then attacks based on parameter leakage are prevented, but timing attacks based on processing time relationships remain vulnerable
Solution Approach 1:
The patent applies preliminary action by adding dummy data to the input data before processing. This dummy data is generated in advance and has the same data structure as the original input data, ensuring that the processing time becomes independent of the actual input data content. The dummy data is added at the beginning of the processing pipeline, before the deep learning model processes the data, thereby preventing timing attacks from the outset.
Solution Approach 2:
The patent uses dummy data as an intermediary between the input data and the deep learning processing. This intermediary dummy data acts as a buffer that absorbs the timing variations caused by different input data characteristics. By processing this intermediary dummy data along with the actual input data, the system masks the true processing time relationships that would otherwise be exploitable by attackers.
2Reliability
If encryption device countermeasures are directly applied, then timing attack resistance improves, but adaptability to deep learning processing is lost
Solution Approach 1:
The patent adapts encryption device countermeasures to deep learning by changing the parameter representation from cryptographic keys to input data. Instead of adding dummy cryptographic operations, the system adds dummy input data that has the same structural parameters as the actual input data. This parameter transformation maintains compatibility with deep learning processing while achieving timing attack resistance.
Solution Approach 2:
The patent creates a universal countermeasure that works across different deep learning models and input data types. The dummy data generation mechanism is model-agnostic and can be applied to various deep learning architectures (CNN, RNN, Transformer, etc.) and different input data formats (images, text, audio). This universal approach maintains adaptability while providing consistent timing attack protection.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A learning-and-recognition apparatus (200) includes a learning-and-recognition unit (102) to perform learning-and-recognition processing on input data (101) and output output data and a time control unit (111) to cause a processing time of the learning-and-recognition unit (102) on the input data (101) to be independent of the input data. The time control unit (111) includes an input control unit (112) to perform processing on the input data (101) to change the processing time of the learning-and-recognition unit (102). The input control unit (112) has a data masking unit (201) to apply random noise to the input data.