WO2019196672A1

WO2019196672A1 - Chip security evaluation method and apparatus, and storage medium

Info

Publication number: WO2019196672A1
Application number: PCT/CN2019/080301
Authority: WO
Inventors: 唐有
Original assignee: 国民技术股份有限公司
Priority date: 2018-04-09
Filing date: 2019-03-29
Publication date: 2019-10-17
Also published as: CN110363033A

Abstract

Provided are a chip security evaluation method and apparatus, and a storage medium. The method comprises: acquiring leakage data when a chip to be tested is currently working (S101); determining a security evaluation level according to the leakage data and a pre-set security evaluation model, the security evaluation model being obtained by training a pre-set leakage sample according to a deep learning algorithm (S102); and determining, according to the security evaluation level, whether the chip to be tested leaks sensitive data (S103). By means of the method, leakage data when a chip is working is input into a trained security evaluation model to predict whether a target analysis object leaks sensitive data, which is particularly suitable for conducting security evaluation on a leakage sample with a low signal-to-noise ratio and a complex analysis object, so that the accuracy of results is improved and the manpower investment can be effectively reduced.

Description

Chip safety evaluation method, device and storage medium

Technical field

Embodiments of the present invention relate to the field of chip information security technologies, and in particular, to a chip security evaluation method, apparatus, and storage medium.

Background technique

With the rapid development of computer, network, communication and integrated circuit technologies, as well as the general trend of social information, chips have been widely used in various environments. However, with the deepening of information security research, various bypass attacks seriously threaten the security features of the chip. For a practical application chip, its hardware components will inevitably leak some information during the operation, and the chip is leaked according to the leakage information. The attack is a bypass attack, thereby obtaining sensitive information in the chip. In order to ensure the safety of the chip, the chip will usually be analyzed and evaluated by the manufacturer and the safety product testing organization before leaving the factory.

At present, the commonly used chip bypass analysis collects the power leakage curve or the electromagnetic radiation leakage curve during the working of the chip, and then analyzes the sensitive information such as the key by means of the traditional mathematical statistics method, but with the hardware process and protection of the security product. With the continuous improvement of the strategy, most security chips currently use some security protection measures to protect against side channel attacks, such as power consumption smoothing, random noise sources, etc., thereby reducing the signal-to-noise ratio of energy leakage collected in the normal mode. Therefore, the signal-to-noise ratio of the waveform acquired in the above manner is very low, and in most cases, the conventional analysis method is often difficult to fully discover its potential security hole.

In view of this, there is a need for a more comprehensive and effective chip security evaluation method to improve the applicability and accuracy of chip bypass analysis in practical applications.

technical problem

The embodiment of the invention provides a chip security evaluation method, device and storage medium, which solves the problem of chip bypass analysis by using the traditional mathematical statistics method in the prior art, which has limited applicability and low accuracy. Technical problem.

Technical solution

In order to solve the above technical problem, the embodiment of the present invention adopts the following technical solutions:

The embodiment of the invention provides a chip security evaluation method, and the chip security evaluation method includes:

Obtaining leak data when the chip to be tested is currently working;

The security assessment level is determined according to the leakage data and the preset security assessment model; the security assessment model is obtained by training the preset leaked sample according to the deep learning algorithm;

Determine whether the chip to be tested leaks sensitive data according to the security evaluation level.

Further, the leakage data is multi-dimensional leakage data, and the multi-dimensional leakage data includes at least two of power consumption change data, electromagnetic signal data, instruction execution time data, and error data.

Further, obtaining leakage data when the chip to be tested is currently working includes:

Obtain the leak data of the internal trace when the chip under test is currently working.

Further, before determining the security assessment level based on the leakage data and the preset security assessment model, the method further includes:

The leakage data is preprocessed; the preprocessing includes at least one of data denoising processing, data compression processing, data format conversion processing, and data selection processing.

Further, when it is determined that the sensitive data of the chip to be tested is leaked according to the security evaluation level, the method further includes:

Sensitive data is determined by analyzing leaked data.

An embodiment of the present invention provides a chip security evaluation apparatus, where the chip security evaluation apparatus includes: a data acquisition module, a security evaluation module, and a leakage determination module;

The data acquisition module is configured to obtain leakage data when the chip to be tested is currently working;

The security evaluation module is configured to determine a security assessment level according to the leakage data and a preset security assessment model; the security assessment model is obtained by training the preset leakage sample according to the deep learning algorithm;

The leak judgment module is configured to determine whether the chip to be tested leaks sensitive data according to the security evaluation level.

Further, the data acquisition module is further configured to acquire leak data of internal traces when the chip to be tested is currently working.

Further, the method further includes: a data preprocessing module;

The data preprocessing module is configured to preprocess the leaked data; the preprocessing includes at least one of data denoising processing, data compression processing, data format conversion processing, and data selection processing.

Further, the method further includes: a data determining module;

The data determining module is configured to determine the sensitive data by analyzing the leakage data when the leakage judgment module determines that the sensitive data of the chip to be tested is leaked according to the security evaluation level.

Embodiments of the present invention provide a storage medium storing one or more programs, and one or more programs may be executed by one or more processors to implement the steps of the chip security evaluation method described above.

Beneficial effect

The embodiment of the invention provides a chip security evaluation method, device and storage medium, and the chip bypass analysis is performed by using the traditional mathematical statistics method in the prior art, which results in limited applicability and low accuracy. Defect, the chip security evaluation method includes: obtaining leakage data of the current working chip to be tested; determining a security evaluation level according to the leakage data and a preset security evaluation model; and the security evaluation model performing the predetermined leakage sample according to the deep learning algorithm Obtained by training; judge whether the chip to be tested leaks sensitive data according to the security evaluation level. Through the implementation of the embodiment of the present invention, the leak data of the chip operation is input into the trained safety evaluation model to obtain the safety evaluation classification mark of the target analysis object, and then the target analysis object leaks sensitive data according to the safety evaluation classification mark. The prediction is especially suitable for the safety evaluation of leaked samples with low SNR and complex analysis objects, which improves the accuracy of the results and can effectively reduce the manpower input.

DRAWINGS

1 is a basic flowchart of a chip security evaluation method according to Embodiment 1 of the present invention;

FIG. 2 is a basic flowchart of acquiring leakage data of internal traces of a chip according to Embodiment 1 of the present invention; FIG.

3 is a detailed flowchart of a chip security evaluation method according to Embodiment 2 of the present invention;

4 is a structural block diagram of a chip security evaluation apparatus according to Embodiment 3 of the present invention;

FIG. 5 is a structural block diagram of a data acquisition module according to Embodiment 3 of the present invention.

Embodiments of the invention

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only some embodiments of the embodiments of the present invention, but not all embodiments. . Based on the embodiments in the embodiments of the present invention, all other embodiments obtained by those skilled in the art without any inventive work are within the scope of the embodiments of the present invention.

The embodiments of the present invention are further illustrated by the specific embodiments and the accompanying drawings.

实施例一：Embodiment 1:

FIG. 1 is a basic flowchart of a chip security evaluation method according to Embodiment 1. The chip security evaluation method specifically includes the following steps:

S101. Obtain leak data when the chip to be tested is currently working.

Specifically, in practical applications, the bypass signal generated by the chip during operation is leaked through the on-chip power supply network, and can be detected by the external, and the leaked bypass signal includes: power consumption change data, Electromagnetic signal data, instruction execution time data, error data, and the like. For example, a conventional way to collect power consumption change data is to build a power consumption acquisition platform by means of an oscilloscope, a PC, a communication control software, and a power consumption acquisition circuit, and connect a suitable resistor to the chip to be tested, and then externally connect by means of an oscilloscope. The voltage curve across the resistor, the power consumption curve.

Optionally, obtaining leakage data when the chip to be tested is currently working includes: obtaining leakage data of internal traces when the chip to be tested is currently working.

FIG. 2 is a basic flowchart of acquiring leakage data of an internal trace of a chip in the embodiment, which specifically includes the following steps:

S201. Identify key modules and traces of the chip to be tested, and locate the target internal trace.

Specifically, according to the characteristics of each layer of the chip to be tested, the key module, the type and location of the traces in the chip to be tested are identified, and then the position of the internal trace of the target is determined, and the power consumption change data (current or voltage information) is usually used. When collecting, it is necessary to open the hole by focusing the ion beam to expose the internal trace, which is convenient for probe contact to detect the contact of the signal, and if the electromagnetic signal data (electric field or magnetic field information) is collected, it may not The opening is performed and the detection is performed by a non-contact method. Preferably, the target internal trace in this embodiment is a power branch trace inside the chip to be tested, a cryptographic circuit signal trace or other suitable trace.

S202: Position the probe in the target internal routing, and send an instruction to control the chip to be tested to perform a corresponding operation.

S203. The control probe detects the leakage data of the internal trace of the target chip to be tested in real time.

S204. Collect leakage data detected by the probe.

Specifically, when the chip to be tested performs the corresponding operation, an appropriate key time point may be selected to collect the leakage data of the internal trace acquired by the probe.

It should be noted that most security chips currently use some security protection measures to protect against bypass attacks, such as power consumption smoothing, random noise sources, etc., thereby reducing the signal-to-noise ratio of energy leakage collected in the normal mode. Therefore, the signal-to-noise ratio of the waveform collected in the above conventional manner is very low. Based on this, in this embodiment, the bypass signal of the chip leakage is obtained from the outside of the chip, and the internal wiring of the chip is directly routed to obtain the leakage side. Road signals, even for some chips that use low-power technology and protection (especially noise circuits), can improve the accuracy of the attack and the signal-to-noise ratio of the leak curve obtained, and can selectively bypass some Safety measures to achieve a more comprehensive safety assessment, more practical.

Optionally, the leakage data is multi-dimensional leakage data, and the multi-dimensional leakage data includes at least two of power consumption change data, electromagnetic signal data, instruction execution time data, and error data.

Specifically, the currently used chip bypass analysis is based on a single power leakage curve or an electromagnetic radiation leakage curve for sample collection, and in order to improve the comprehensiveness of the chip security evaluation, this embodiment uses multi-dimensional leakage data as The analysis object, the multi-dimensional leakage data includes at least two kinds of leakage data, for example, the power consumption change data and the electromagnetic signal data are simultaneously acquired and packaged together, so that the analysis object has more sufficient information, when the analysis object is a single leak data. A more comprehensive safety assessment can be achieved.

S102. Determine a security assessment level according to the leakage data and a preset security assessment model. The security assessment model is obtained by training the preset leakage sample according to the deep learning algorithm.

Specifically, the manner of establishing the security assessment model in this embodiment includes but is not limited to the following manners:

First, the training sample S is prepared, wherein the training sample may be a sample determined by collecting historical leak data of the chip to be tested, or may be a sample determined by collecting leakage data of other chips of the same type, and may be pre-predetermined. The expert data is the sample with certain scientific laws provided by the engineers after repeated research. The training sample may be a single sample or may be composed of multiple different types of samples. The training sample S includes a feature vector F and a corresponding classification mark C. The feature vector F is the leaked data when the chip is working. If the multi-dimensional leak data is used, the feature vector includes a plurality of feature parameters; the classification mark C is According to a certain classification standard, each feature vector is correspondingly graded. In this embodiment, it is used to classify the severity of the leaked data, for example, it is divided into C1, C2, etc., and can take values C1=1, C2=2. Etc., the feature vector F and the corresponding classification mark C form a sample S, which can be expressed by the following formula: S = [F, C].

Then, through the supervised learning algorithm in the deep learning algorithm, that is, the input data has clear classification marks and output results to train the model, the logistic regression, Adaboost algorithm, etc. with faster calculation speed can be used, and the accuracy can be adopted. A high algorithm, such as the popular Amazon MXNet framework algorithm, etc., so that the security evaluation model in this embodiment is established, and based on the established security evaluation model, the leaked data of the currently acquired chip is input to the model. In the middle, the corresponding classification mark can be output to represent the current safety assessment level. Since the correlation between the leakage data and the safety assessment level can be effectively summarized after being fully trained, it is more suitable for the safety assessment of leaked samples and complex analysis objects with low SNR.

Optionally, before determining the security assessment level according to the leakage data and the preset security assessment model, the method further includes: preprocessing the leakage data; the preprocessing includes: data denoising processing, data compression processing, data format conversion processing, and data Select at least one of the processes.

Specifically, in this embodiment, in order to further improve the efficiency of the security assessment and the accuracy of the evaluation result, the leaked data is pre-processed before the leakage data is input into the security assessment model, wherein the data denoising process can Data loss processing, such as baseline drift noise and power frequency interference, can be reduced. Data compression processing can reduce the leaked data into a desired data format, and data selection processing is obtained from the data acquisition process. Only specific data is intercepted in the leaked data as an analysis object.

S103. Determine, according to the security evaluation level, whether the chip to be tested leaks sensitive data.

Specifically, the security assessment level indicates the degree of impact of the current leakage data on the security of the chip, and the difference in the leakage data corresponds to different chip security conditions. In some embodiments, the security assessment levels may be classified as: C1, C2. , C3, C4, C5, from C1 to C5, the degree of influence of leakage data on chip security increases sequentially, and C3 is set as the level threshold. That is, the impact of leakage data on C1 and C2 levels on chip security is still slight, insufficient In order to have a substantial impact on the security of the chip, that is, the leaked data is not enough to be used to analyze the sensitive data of the chip. The sensitive data of the chip includes the key of the chip's cryptographic algorithm, the type of operation currently performed by the chip, and the like. C3 is the critical point. In this case, the data currently leaked by the chip can already be tried to analyze the sensitive data, that is, the leakage data at this level has begun to threaten the security of the chip, and exceeds the level threshold, the security of the chip. The threat is gradually increasing. The deep learning algorithm is used to evaluate the security of the chip, so that the judgment accuracy of the final chip whether the leakage of sensitive data is judged is greatly improved, and it can represent the current real security status of the chip.

Optionally, when the sensitive data of the chip to be tested is determined to be leaked according to the security evaluation level, the method further includes: analyzing the leakage data to determine the sensitive data.

Specifically, in the embodiment, after obtaining the judgment result of whether the chip leaks sensitive data, if the current judgment result is yes, an attempt is also made to recover the specific leaked sensitive data. The recovery of sensitive data depends on the correlation between the leakage curve of the chip in the operation process and sensitive information such as the key. In the normal block cipher algorithm, a long key will be removed during the actual encryption and decryption process. Divided into multiple subkeys, for example, the 48-bit key that DES actually participates in is divided into 8 groups, each group of 6 bits, and the 128-bit AES is similar, and the 128-bit key is split into 16 Group, each group of 8 bits, and the information XOR after participating in the subsequent transformation. This can be exploited by an attacker. It is easy to traverse 6bits or 8bits subkeys, analyze based on leaked data, obtain a part of key information first, and then traverse the remaining key packets one by one to obtain the overall key information.

The embodiment of the invention provides a chip security evaluation method, which is directed to the chip bypass analysis by using the traditional mathematical statistics method in the prior art, which has the disadvantages of limited applicability and low accuracy, and the chip security The method includes: obtaining leakage data when the chip to be tested is currently working; determining a security evaluation level according to the leakage data and a preset safety evaluation model; and the safety evaluation model is obtained by training the preset leakage sample according to the deep learning algorithm; The security evaluation level determines whether the chip to be tested leaks sensitive data. The safety assessment classification mark of the target analysis object is obtained by inputting the leak data of the chip work into the trained safety evaluation model, and then the target analysis object is predicted to leak sensitive data according to the safety evaluation classification mark, which is especially suitable for Leaked samples with low SNR and complex analysis objects carry out safety assessment, which improves the accuracy of results and can effectively reduce manpower input.

实施例二：Embodiment 2:

FIG. 3 is a detailed flowchart of a chip security evaluation method according to Embodiment 2 of the present invention, which specifically includes the following steps:

S301. Acquire multi-dimensional leakage data of internal traces when the chip to be tested is currently working; the multi-dimensional leakage data includes at least two of power consumption change data, electromagnetic signal data, instruction execution time data, and error data.

Specifically, in this embodiment, the conventional bypass signal obtained by acquiring the chip leakage from the outside of the chip is directly obtained from the internal wiring of the chip to obtain the leaked bypass signal, thereby improving the accuracy of the attack and the signal noise of the leaked curve obtained. Moreover, in this embodiment, the multi-dimensional leak data is collected and used as an analysis object, so that the analysis object has more sufficient information, and a more comprehensive security evaluation can be realized when the analysis object is a single leaked data.

S302. Perform pre-processing on the multi-dimensional leakage data. The pre-processing includes at least one of data denoising processing, data compression processing, data format conversion processing, and data selection processing.

Specifically, in this embodiment, in order to further improve the efficiency of the security assessment and the accuracy of the evaluation result, the acquired leakage data is also preprocessed, and then the processed leakage data is input into the security assessment model.

S303. Determine a security assessment level according to the pre-processed multi-dimensional leakage data and a preset security assessment model. The security assessment model is obtained by training the preset leakage sample according to the deep learning algorithm.

Specifically, the correlation between the leaked data and the security assessment level can be effectively summarized after being fully trained, so that it is more suitable for the safety assessment of leaked samples and complex analysis objects with low SNR.

S304. Determine, according to the security evaluation level, whether the chip to be tested leaks sensitive data; if yes, execute S305, if no, execute S301.

The deep learning algorithm is used to evaluate the security of the chip, so that the judgment accuracy of the final chip whether the leakage of sensitive data is judged is greatly improved, and it can represent the current real security status of the chip.

S305. Analyze the multi-dimensional leak data to determine the sensitive data.

The embodiment of the invention provides a chip security evaluation method, which collects multi-dimensional leakage data during chip operation, and then preprocesses the multi-dimensional leakage data and inputs it into the post-training security evaluation. The model outputs the corresponding security assessment level, and predicts whether the chip leaks sensitive data according to the security evaluation level, and also determines the specific sensitive data when the sensitive data is leaked. The use of multi-dimensional leak data as an analysis object to improve the comprehensiveness of security assessment, and the use of deep learning algorithms for security assessment, improve the applicability and accuracy of the evaluation of low SNR leaked samples, complex analysis objects Sex.

实施例三：Embodiment 3:

The present embodiment provides a chip security evaluation device. For details, refer to FIG. 4. The chip security evaluation device includes: a data acquisition module 41, a security evaluation module 42 and a leak determination module 43. The data acquisition module 41 is configured to acquire Measuring the leakage data of the current working of the chip; the security evaluation module 42 is configured to determine the security evaluation level according to the leakage data and the preset security evaluation model; the security evaluation model is obtained by training the preset leakage sample according to the deep learning algorithm; The module 43 is configured to determine whether the chip to be tested leaks sensitive data according to the security evaluation level.

Specifically, the bypass signal generated by the chip during operation is leaked through the on-chip power supply network, and can be detected by the data acquisition module 41. The specifically bypassed signal includes: power consumption change data and electromagnetic signal. Data, instruction execution time data, error data, and the like.

In addition, the security assessment module 42 determines the security assessment level corresponding to the leaked data through a deep learning algorithm. First, the training sample S is prepared, wherein the training sample may be a sample determined by collecting historical leak data of the chip to be tested, or may be a sample determined by collecting leakage data of other chips of the same type, and may be pre-predetermined. The expert data is the sample with certain scientific laws provided by the engineers after repeated research. The training sample may be a single sample or may be composed of multiple different types of samples. The training sample S includes a feature vector F and a corresponding classification mark C. The feature vector F is the leaked data when the chip is working. If the multi-dimensional leak data is used, the feature vector includes a plurality of feature parameters; the classification mark C is Corresponding grading of each feature vector according to a certain classification criterion is used to classify the severity of the leaked data in the present embodiment. The feature vector F and the corresponding classification mark C form a sample S, which can be expressed by the following formula. :S=[F,C]. Then, through the supervised learning algorithm in the deep learning algorithm, that is, the input data has clear classification marks and output results to train the model, the logistic regression, Adaboost algorithm, etc. with faster calculation speed can be used, and the accuracy can be adopted. High algorithms, such as the now popular Amazon MXNet framework algorithm, etc., so that the security evaluation model in this embodiment is established. Based on the established security evaluation model, the security evaluation module 42 will disclose the leaked data of the currently acquired chip. Entering into the model, you can output the corresponding classification mark to represent the current safety assessment level. Since the correlation between the leakage data and the safety assessment level can be effectively summarized after being fully trained, it is more suitable for the safety assessment of leaked samples and complex analysis objects with low SNR.

It should be noted that the security evaluation level in this embodiment represents the degree of impact of the current leakage data on the security of the chip, and the difference in the leakage data corresponds to different chip security conditions, and the leakage determination module 43 determines the security evaluation level. Whether the leaked data has a substantial impact on the security of the chip, that is, whether the sensitive data of the chip can be analyzed according to the leaked data, the sensitive data of the chip includes the key of the chip's cryptographic algorithm, the type of operation currently performed by the chip, and the like. In this embodiment, the depth evaluation algorithm is used to evaluate the security of the chip, so that the judgment accuracy of the final chip whether the leakage of the sensitive data is judged is greatly improved, and the current real security status of the chip is more representative.

Optionally, the data obtaining module 41 is further configured to obtain leak data of internal traces when the chip to be tested is currently working.

As shown in FIG. 5, a block diagram of a data acquisition module is provided in this embodiment. The data acquisition module 41 in this embodiment includes a positioning submodule 411, a control submodule 412, and a collection submodule 413.

The locating sub-module 411 is configured to identify the key modules and the traces of the chip to be tested, and locate the target internal traces. Specifically, the locating sub-module 411 identifies the key modules in the chip to be tested according to the characteristics of the layers of the chip to be tested. Trace type and position, and then determine the position of the target internal trace. Usually, when collecting power consumption change data (current or voltage information), it is necessary to open the hole by focusing the ion beam to expose the internal trace. The needle is lapped to perform contact detection of the signal, and when the electromagnetic signal data (electric field or magnetic field information) is acquired, the detection can be performed by the non-contact method without performing the opening. Preferably, the target internal trace in this embodiment is a power branch trace inside the chip to be tested, a cryptographic circuit signal trace or other suitable trace.

The control sub-module 412 is configured to position the probe on the target internal trace, and send an instruction to control the chip to be tested to perform a corresponding operation, and the control probe to detect the leak data of the internal trace of the target chip to be tested in real time.

The collection sub-module 413 is configured to collect leakage data detected by the probe.

In this embodiment, the bypass signal of the chip leakage is obtained from the outside of the chip, and the bypass signal is directly obtained from the internal wiring of the chip, even for some low-power technologies and protective measures (especially noise circuits). The chip can also improve the accuracy of the attack and the signal-to-noise ratio of the leak curve obtained, and can selectively bypass some safety protection measures to achieve a more comprehensive safety assessment and more practical operability.

Optionally, the method further includes: a data preprocessing module; the data preprocessing module is configured to perform preprocessing on the leaked data; and the preprocessing includes at least one of data denoising processing, data compression processing, data format conversion processing, and data selection processing. Kind.

Specifically, in this embodiment, in order to further improve the efficiency of the security evaluation and the accuracy of the evaluation result, the leaked data is preprocessed by the data preprocessing module before the leakage data is input to the security evaluation module, where The data denoising process can remove the baseline drift noise and power frequency interference of the data, the data compression processing can reduce the data amount of the leaked data, and the data format conversion processing can convert the obtained leaked data into a desired data format, and the data selection processing is performed. It is to analyze only the specific data from the leaked data obtained as the analysis object.

Optionally, the method further includes: a data determining module, where the data determining module is configured to determine the sensitive data when the leakage determining module determines that the sensitive data of the chip to be tested is leaked according to the security evaluation level.

In the embodiment, after obtaining the judgment result of whether the chip leaks the sensitive data, if the current judgment result is yes, the data determination module is further tried to recover the specific leaked sensitive data. The recovery of sensitive data depends on the correlation between the leakage curve of the chip in the operation process and sensitive information such as the key. In the normal block cipher algorithm, a long key will be removed during the actual encryption and decryption process. Divided into multiple subkeys, for example, the 48-bit key that DES actually participates in is divided into 8 groups, each group of 6 bits, and the 128-bit AES is similar, and the 128-bit key is split into 16 Group, each group of 8 bits, and the information XOR after participating in the subsequent transformation. This can be exploited by an attacker. It is easy to traverse 6bits or 8bits subkeys, analyze based on leaked data, obtain a part of key information first, and then traverse the remaining key packets one by one to obtain the overall key information.

The embodiment of the present invention provides a chip security evaluation device, which includes: a data acquisition module, a security evaluation module, and a leakage determination module; and the data acquisition module is configured to acquire leakage data when the chip to be tested is currently working; The security assessment module is configured to determine a security assessment level according to the leakage data and a preset security assessment model; the security assessment model is obtained by training the preset leakage sample according to the deep learning algorithm; and the leakage determination module is configured to determine the to-be-tested according to the security assessment level Whether the chip leaks sensitive data. The safety assessment classification mark of the target analysis object is obtained by inputting the leak data of the chip work into the trained safety evaluation model, and then the target analysis object is predicted to leak sensitive data according to the safety evaluation classification mark, which is especially suitable for Leaked samples with low SNR and complex analysis objects carry out safety assessment, which improves the accuracy of results and can effectively reduce manpower input.

It should be understood that the data acquisition module 41, the security evaluation module 42 and the leak determination module 43 in this embodiment may all be deployed on the terminal, or may be deployed on the server; or part of the solution is deployed on the terminal, and part of the solution is deployed on the server. on. For example, the data acquisition module 41 and the security evaluation module 42 are deployed on the terminal, the leakage determination module 43 is deployed on the server, or the data acquisition module 41 is deployed on the terminal, and the security evaluation module 42 and the leak determination module 43 are deployed on the server. For the corresponding implementation process of various deployment modes, refer to the foregoing Embodiment 1, and details are not described herein again. It should be understood, however, that in this embodiment, the functionality of each module may be implemented by a processor of the device in which it is deployed. In some examples of the present embodiment, the processor for implementing the corresponding functions of the above modules includes, but is not limited to, a CPU. For example, the functions of the data acquisition module 41, the security evaluation module 42, and the leak determination module 43 may be implemented by the processor. CPU implementation.

实施例四：Embodiment 4:

The present embodiment provides a storage medium that can store one or more computer programs for the processor to read, compile, and execute to implement corresponding functions. For example, in the embodiment, the storage medium stores a chip security evaluation program, and the chip security evaluation program is executable by at least one of the terminal and/or the server to implement the chip security evaluation method introduced in the foregoing embodiments.

It should be understood that the storage medium may be disposed on one hardware device or distributed on multiple hardware devices. When the storage medium is only disposed on one hardware device, it may be set on the terminal or may be set on the server. When the storage medium is disposed on the terminal, it may be a first computer readable storage medium, where the first computer readable storage medium stores one or more first programs, and the one or more first programs may be one or A plurality of processors are executed to allow the terminal to implement the steps of the chip security evaluation method exemplified in the above embodiments. When the storage medium is disposed on the server, it may be a second computer readable storage medium, the second computer readable storage medium storing one or more second programs, the one or more second programs may be one or A plurality of processors are executed to allow the server to implement the steps of the chip security evaluation method exemplified in the above embodiments. When the storage medium is distributed on at least two hardware devices, the storage medium includes at least two storage units that can be separately disposed, and some of the storage units are disposed on the terminal, and are partially disposed on the server, for example, the terminal processor. By reading the computer program in the storage unit disposed thereon, the step of obtaining leakage data when the chip under test is currently working in the chip security evaluation method may be implemented; and the server processor reads the storage unit disposed thereon by reading The computer program can realize the step of determining the security evaluation level according to the leakage data and the preset security evaluation model in the chip security evaluation method; and determining whether the chip to be tested leaks the sensitive data according to the security evaluation level. Alternatively, the computer program in the storage unit disposed thereon may be read by the server processor to obtain the leaked data when the current chip of the chip to be tested is obtained in the chip security evaluation method; according to the leaked data and the preset security evaluation model The step of determining the security evaluation level; and then the step of the terminal processor determining whether the chip to be tested leaks sensitive data according to the security evaluation level is implemented by the terminal processor according to the computer program in the storage unit disposed thereon.

The above is a detailed description of the embodiments of the present invention in conjunction with the specific embodiments, and the specific implementation of the embodiments of the present invention is not limited to the description. For a person skilled in the art to which the present invention pertains, a number of simple derivations or substitutions may be made without departing from the spirit of the embodiments of the present invention.

Claims

A chip security evaluation method, characterized in that the chip security evaluation method comprises:

Obtaining leak data when the chip to be tested is currently working;

Determining a security assessment level according to the leakage data and a preset security assessment model; the security assessment model is obtained by training a preset leaked sample according to a deep learning algorithm;

Determining, according to the security evaluation level, whether the chip to be tested leaks sensitive data.
The chip security evaluation method according to claim 1, wherein the leakage data is multi-dimensional leakage data, and the multi-dimensional leakage data comprises: power consumption variation data, electromagnetic signal data, instruction execution time data, and errors. At least two of the data.
The chip security evaluation method according to claim 1, wherein the obtaining leakage data when the chip to be tested is currently working includes:

Obtaining leak data of the internal traces when the chip to be tested is currently working.
The chip security evaluation method according to claim 1, wherein before determining the security evaluation level according to the leakage data and the preset security evaluation model, the method further comprises:

Pre-processing the leaked data; the pre-processing includes at least one of data denoising processing, data compression processing, data format conversion processing, and data selection processing.
The chip security evaluation method according to any one of claims 1 to 4, further comprising: when determining that the sensitive data of the chip to be tested is leaked according to the security evaluation level, further comprising:

The leaked data is analyzed to determine the sensitive data.
A chip security evaluation device, comprising: a data acquisition module, a security evaluation module, and a leakage determination module;

The data acquisition module is configured to acquire leakage data when the chip to be tested is currently working;

The security evaluation module is configured to determine a security assessment level according to the leakage data and a preset security assessment model; the security assessment model is obtained by training a preset leaked sample according to a deep learning algorithm;

The leak determination module is configured to determine, according to the security assessment level, whether the chip to be tested leaks sensitive data.
The chip security evaluation apparatus according to claim 6, wherein the leaked data is multi-dimensional leak data, and the multi-dimensional leak data includes: power consumption change data, electromagnetic signal data, instruction execution time data, and an error. At least two of the data.
The chip security evaluation device according to claim 6, wherein the data acquisition module is further configured to acquire leakage data of the internal traces when the chip to be tested is currently working.
The chip security evaluation device according to claim 6, further comprising: a data preprocessing module;

The data pre-processing module is configured to perform pre-processing on the leaked data; the pre-processing includes at least one of data denoising processing, data compression processing, data format conversion processing, and data selection processing.
The chip security evaluation apparatus according to any one of claims 6 to 9, further comprising: a data determination module;

The data determining module is configured to determine the sensitive data by analyzing the leaked data when the leak determination module determines that the sensitive data of the chip to be tested is leaked according to the security evaluation level.
A storage medium, characterized in that the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement any one of claims 1 to 5. The steps of the chip security evaluation method.