CN103634102B - A kind of means of defence of side-channel attack and fault attacks - Google Patents

Abstract

The present invention provides a kind of protection method of side-channel attack and fault attack, and this method comprises the following steps: 1, the operation of block cipher algorithm is divided into several stages of pipelines; II, randomly select two stages of pipelines to input real plaintext, other levels The input of is a random number; III. Carry out the operation, and when the operation is finished, compare the two real data to see if the results of the operation are consistent. The method can resist both side-channel attacks and fault attacks, and has strong security and high execution efficiency.

Description

A Defense Method for Side Channel Attack and Fault Attack

technical field

The invention relates to a method in the field of smart card chips, in particular to a protection method for side channel attacks and fault attacks.

Background technique

With the development of computer technology and the continuous improvement of social informatization, information security issues are more and more widely reproduced by people. Encryption, as a powerful weapon in information security, is playing an important role. Various encryption algorithms are constantly emerging. Currently, the more popular block cipher algorithms include DES and AES. A block cipher algorithm is an algorithm for encrypting fixed-length plaintext. It groups the plaintext by a certain length, and encrypts the plaintext and the key to obtain the ciphertext. When decrypting, the ciphertext and key are restored to plaintext through decryption operation.

With the advancement of measurement and analysis methods, various attack methods have also been continuously developed. Side-channel attack and fault attack are two representative attack methods proposed in recent years that are more threatening to chips. Side-channel attacks use the side information leaked during the operation of the cryptographic device to have a certain correlation with the intermediate value of the cryptographic algorithm, and obtain the key information by measuring the side information multiple times and then performing statistical analysis. The basic principle of the fault attack is to put the encryption chip in a strong magnetic field, or change the power supply voltage, operating frequency, temperature, etc. of the chip, so that the registers and memories in the encryption chip will generate random errors during the encryption and decryption process, and some output bits will change from The original 0 becomes 1 or 1 becomes 0. Through the comparison of the correct ciphertext output and the wrong ciphertext output, the secret data information inside the chip is obtained through theoretical analysis. A common defense against side-channel attacks is to perform random masking on data or keys. A common defense against fault attacks is to calculate the same data twice and then compare whether the calculation results are consistent.

The existing method is to divide each round operation of the grouping algorithm into several steps, and perform pipeline operation operation on the basis of the divided steps. Each stage of the pipeline calculates different data, each clock cycle performs different operations on different data, and applies a random number mask to the data processed by each stage of the pipeline to ensure the mutuality of the actual processed data.

As a method of side channel attack, power analysis can only resist power consumption attack, but cannot resist fault attack. To resist both side-channel analysis and fault attacks, the existing technology needs to add other defense methods, which will take up more resources during implementation. Moreover, in the prior art, each circle operation of the symmetric algorithm is divided into several sub-steps. Generally speaking, the symmetric algorithm will contain multiple circle operations. If each circle operation is divided into several sub-steps, the efficiency will be very high when the algorithm is running. Low, it will take many clock cycles to complete an encryption/decryption operation.

Contents of the invention

In order to overcome the above-mentioned defects in the prior art, the present invention provides a protection method for side channel attacks and fault attacks, which can resist both side channel attacks and fault attacks, and has strong security and high execution efficiency.

In order to realize the above-mentioned purpose of the invention, the present invention takes the following technical solutions:

A kind of protection method of side channel attack and fault attack, its improvement is: described method comprises the following steps: 1, the operation of block cipher algorithm is divided into pipeline;

II. Randomly select two-stage pipelines to input real plaintext, and input random numbers at other stages;

III. Carry out the calculation, and when the calculation is finished, compare whether the two real data determined by the calculation result are consistent.

Further, the method uses pipelines at different stages to calculate different data at the same time, and the side information generated by random numbers participating in the operation is used as noise to cover up the side information of real data, thereby resisting side channel attacks.

Further, the method compares the results of the two real ciphertext operations, and if the two operation results are consistent, it is considered that there is no fault during the operation, thereby resisting fault attacks.

Further, said step I includes:

Set the number of round operations of the block cipher algorithm to 2N, where N is a positive integer, and each stage of the pipeline includes k round operations;

Divide the entire operation into n-stage pipelines, n=2N/k, where 2N/k is an integer.

Further, the step II includes:

The input of the A-level pipeline and the B-level pipeline is randomly selected as the real plaintext, and the input of the remaining (n-2)-level pipeline is a random number.

Further, said step III includes:

The plaintext enters the A-level pipeline for calculation, and the remaining (n-1) pipelines input random numbers, and the side information generated by the operation is used as noise to cover up the real side information generated by the plaintext P operation;

The plaintext enters the B-level pipeline for calculation, and the remaining (n-2) pipelines input random numbers, and the side information generated by the operation is used as noise to cover up the real side information generated by the plaintext P operation;

Until the end of the 2N rounds of calculations, two ciphertexts are obtained respectively, and it is judged whether the two ciphertexts are consistent. If they are consistent, the calculation process is considered to be faultless, otherwise an alarm message is issued.

Compared with prior art, the beneficial effect of the present invention is:

1. The method of the present invention solves the problems of low execution efficiency and large resource consumption in the prior art, or often only considers the resistance to side channel attacks, but ignores the resistance to fault attacks, or on the contrary, so the problem of low security, The method of the invention can not only resist side channel attack, but also resist fault attack, has strong security and high execution efficiency.

2. The method of the present invention selects the appropriate number of pipeline stages according to the limitation of hardware resources, which is convenient and flexible during implementation, and has high execution efficiency.

3. The method of the present invention combines protection methods against side-channel attacks and fault attacks, which greatly reduces the additional resources increased due to protection, and is easy to implement.

4. The method of the present invention can not only maintain high computing efficiency when performing encryption and decryption operations on a large amount of data, but also have strong security protection capabilities.

Description of drawings

Fig. 1 is the flow chart of using the inventive method;

Fig. 2 is the flow chart that utilizes the inventive method to carry out DES algorithm

detailed description

The present invention will be further described below in conjunction with accompanying drawing.

The invention provides a protection method against side channel attack and fault attack, and the method adopts pipeline technology. The method of the present invention is as follows: the operation of the block cipher algorithm is divided into several stages of pipelines, and two stages of pipelines are randomly selected, the input of the two stages of pipelines is real plaintext, and the input of other stages is random numbers.

Because at the same time, different levels of pipelines use different data to participate in the operation, and the side information generated when the random number participates in the operation is used as noise to cover up the side information generated by the real data participating in the operation, so that it can resist side channel attacks.

By comparing the operation results of the two real data at the end of the operation, if they are consistent, it is considered that there is no fault attack, so that the fault attack can be resisted. The operation refers to the encryption or decryption operation of the block cipher.

Generally, the number of round operations of the block cipher algorithm is an even number. It is assumed that the number of round operations of the block cipher algorithm is 2N, and N is a positive integer. It is assumed that each stage of the pipeline includes k round operations. Divide the entire operation into n=2N/k-level pipelines, k needs to be able to decompose 2N, that is, 2N/k is an integer, and the appropriate number of pipeline stages can be selected according to the limitations of hardware resources, which is convenient and flexible in implementation. The input of the two-stage pipeline is randomly selected as the real plaintext, and the input of the remaining (n-2) pipeline is a random number.

As shown in Figure 1, Fig. 1 is the flow chart of using the method of the present invention; In the present embodiment, assume that block cipher algorithm round operand is 2N, N is a positive integer, 2N/k is an integer; Assume that the first level and the second The input of the first stage pipeline is the real plaintext P, and the input of the third stage to the nth stage pipeline is a random number. Then the steps in the operation process are as follows:

1. At Time1, the first plaintext P enters the first-stage pipeline for the first to k-th rounds of calculations. At this time, the input of the second-stage to n-stage pipelines is random numbers, and the second-stage and n-stage pipelines The side information generated by the operation of P will be used as noise to cover up the real side information generated by the plaintext P operation.

2. At Time2, the first plaintext P enters the second-stage pipeline for calculations from k+1 to 2k rounds, and the second plaintext P enters the first-stage pipeline for calculations from 1st to k-th rounds. The input of the pipeline from the third stage to the nth stage is a random number, and the side information generated by its operation will be used as noise to cover up the real side information generated by the plaintext P operation.

3. At Time3, the first plaintext P enters the third-stage pipeline for calculations from 2k+1 to 3k rounds, and the second plaintext P enters the second-stage pipeline for calculations from k+1 to 2k rounds. The random number enters the first-stage pipeline for the first to k-th rounds of operations. At this time, the input of the fourth-stage to the n-th-stage pipeline is a random number, and the side information generated by the operation will be used as noise to cover up the real side generated by the plaintext P operation. information.

4. By analogy, at Time n, the first plaintext P enters the nth-stage pipeline for (n-1)k+1 to nkth rounds of calculations. So far, the encryption of the first plaintext P is completed, and the first A ciphertext C.

5. At Time n+1, the second plaintext P will also be encrypted, and the second ciphertext C will be obtained; compare whether the first ciphertext C is equal to the second ciphertext C, if the two ciphertexts are equal It means that there is no injection fault during the operation, and the encryption result is available; otherwise, a corresponding alarm message will be generated.

Using the DES algorithm as an example to illustrate, the DES algorithm has 16 rounds of operations, which are divided into four-stage pipelines, and each stage of the pipeline contains 4 rounds of operations. The oblique line in the figure indicates that random numbers participate in the operations of this stage of the pipeline. Specific steps are as follows:

1. At Time1, the first plaintext P enters the first-stage pipeline for the first to fourth rounds of calculation. At this time, the input of the second-stage to the fourth-stage pipeline is a random number, and the input of the second-stage to the fourth-stage pipeline The side information generated by the operation will be used as noise to cover up the real side information generated by the plaintext P operation.

2. At Time2, the first plaintext P enters the second-stage pipeline for the 5th to 8th round of calculation, and the second plaintext P enters the first-stage pipeline for the 1st to 4th round of calculation. At this time, the third stage to The input of the fourth-stage pipeline is a random number, and the side information generated by its operation will be used as noise to cover up the real side information generated by the plaintext P operation.

3. At Time3, the first plaintext P enters the third-stage pipeline for the 9th to 12th round of calculation, the second plaintext P enters the second-stage pipeline for the 5th to 8th round of calculation, and the random number enters the first stage The pipeline performs the first to fourth rounds of calculation. At this time, the input of the fourth pipeline is a random number, and the side information generated by the operation will be used as noise to cover up the real side information generated by the plaintext P operation.

4. At Time4, the first plaintext P enters the fourth-stage pipeline for the 13th to 16th rounds of calculation. So far, the encryption of the first plaintext P is completed, and the first ciphertext C is obtained;

The second plaintext P enters the third-stage pipeline for calculations in the 9th to 12th rounds, and the random numbers enter the second-level and first-level pipelines for the 5th to 8th and 1st to 4th rounds of calculations.

5. At Time5, the second plaintext P will also be encrypted, and the second ciphertext C will be obtained.

Compare whether the first ciphertext C and the second ciphertext C are equal. If the two ciphertexts are equal, it means that there is no injection fault during the operation and the encryption result is available; otherwise, a corresponding alarm message will be generated.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that: the present invention can still be Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention shall be covered by the scope of the claims of the present invention.

Claims (1)

1. the means of defence of a kind of side-channel attack and fault attacks, it is characterised in that：It the described method comprises the following steps：I, general The computing of block cipher is divided into streamline；

II, random selection two level production lines input are real in plain text, and other inputs at different levels are random number；

III, progress computing, when computing terminates, whether two True Datas that comparison operation result is determined are consistent；

Methods described is by the way that in the different data of synchronization pipeline operation not at the same level, random number participates in the side that computing is produced Information as noise takeover True Data side information, so as to resist side-channel attack；

Methods described by the way that two true ciphertext computings are terminated after Comparative result, if two operation results are consistent, then it is assumed that Do not broken down in calculating process, so as to resist fault attacks；

The step I includes：

Block cipher wheel operand is set as 2N, N is positive integer, each level production line includes k wheel computing；

Whole computing is divided into n level production lines, n=2N/k, 2N/k is integer；

The step II includes：

It is real plaintext to randomly select the input of A level production lines and B level production lines, and the input of remaining (n-2) level production line is Random number；

The step III includes：

Enter A level production lines in plain text and carry out computing, remaining (n-1) level production line input random number, and the side information that computing is produced The true side information produced as noise takeover plaintext P computings；

Enter B level production lines in plain text and carry out computing, remaining (n-2) level production line input random number, and the side information that computing is produced The true side information produced as noise takeover plaintext P computings；

Until 2N wheel computings terminate, two ciphertexts are obtained respectively, judge whether two ciphertexts are consistent, unanimously then think calculating process Fault-free, otherwise sends a warning.