流水线电磁辐射旁路分析新方法研究

Side-channel attacks analyze the relation between the power consumption or electromagnetic radiation of a cryptographic device and the handled data during cryptographic operations. A classical side-channel has several drawbacks. It results in a significant noise level that makes detecting key leaking parts of the signal virtually impossible, even with averaging. In this research, principle of EM side-channel signals in CMOS devices and spectrum characteristics of signals and noise will be studied. Then a new testing platform will be built, it will surpass conventionally available solutions through an innovative, substantially more powerful waveform measuring technique - Pipeline Electromagnetic Emission Analysis (PEEA). Noise which affects the useful leakage signal will be reduced through difference operation. Specific hardware will be designed which used to capture weak leakage signal. The platform will have unique features including its high speed, high sensitivity, comparative low cost and the ability to perform waveform analysis in real-time without any need for expensive SCA equipment. With the knowledge gained from evaluations generated by PEEA, researchers will be able to understand potential weaknesses and discover previously unknown vulnerabilities, which remain undetected by conventional evaluation systems. With the PEEA platform, commercial smart card system will be attacked combine with side-channel disassembling; encryption algorithm which implemented in high-end military grade FPGA will be decrypted by analyzing its JTAG protocol, and technical preparation will be made for disclosing hardware "backdoor". Cryptographic device in real world will be analyzed, which change the status that stayed in laboratory or simulation, and new method for high-end cryptographic chip decrypting and safety assessing will be introduced.

旁路攻击利用统计分析方法，通过辨析密钥与泄漏信号的相关性来破解密钥。对于泄漏信号混合在噪声环境下的实际加密系统，传统旁路攻击成功率极低。课题在研究CMOS电磁辐射机理，分析噪声和有用信号电磁频谱的基础上，扬弃以通用示波器为核心的测试方法，采用流水线电磁辐射波形分析技术；运用差分运算降低噪声对有效信号的干扰；设计专用硬件模块采集和分析微弱旁路泄漏信号，无需复杂高昂的数字化测量设备；实现高速、高度灵敏、低成本的波形分析，达到实时破解密码的目标；发现芯片潜在的弱点并发现芯片在传统旁路攻击环境中未知的脆弱性。结合旁路反汇编技术对实际商用智能卡系统进行攻击；通过分析高端军用级FPGA的JTAG协议，破解其加密算法，并为揭秘其存在的硬件"后门"做技术准备。课题以实际产品为分析对象，改变旁路攻击一直徘徊于实验室及仿真试验的现状，为实际产品特别是高端芯片密码的破解和安全评估寻求新的方法。

集成电路(IC)芯片在军事系统、金融基础设施等众多领域的广泛应用，带来了IC处理的数据信息以及配置信息的安全问题。为解决这些问题，出现了以密码技术为核心提供安全保障的硬件模块，密码芯片为其典型代表。密码芯片在工作中会产生功耗、电磁辐射、光辐射等能量消耗（称为旁路信号），其中蕴含了与芯片内部运算相关的信息。1996年，Paul kocher提出旁路攻击，之后旁路密码分析成为芯片安全研究的新方向。在该方向中多数为旁路区分器的研究，发表了数量众多的相关工作报告、学位论文以及学术论文。关于如何获取高质量旁路信号、信号质量如何评估、如何对密码芯片进行安全评估等方面仍鲜见报道。.本项目主要研究内容如下：.（1）研究了电磁泄漏信号获取手段与有用信号提取方法。采用电磁云图方法根据辐射特性确定不同模块的物理位置，定位电磁探头，另一方面电磁探头特性应满足电磁旁路信号采集的频谱特性要求，才能够采集到高质量的旁路信号。.（2）建立了信噪比量化评估方法。不仅可对旁路信号质量进行量化评估，还能结合旁路分析技术为密码芯片的安全性评估提供方法和理论依据。.（3）利用差分和时钟同步方法建立旁路信号采集系统，并研究开发了基于差分同步的旁路安全评估平台，提出了差异度分析模型，实现了密码芯片的小样本量快速破解。.（4）对旁路区分器分类，优化了现有无原型旁路区分器；探讨将深度学习方法引入有原型旁路区分器建模过程，并取得初步成果。.（5）建立了密码芯片旁路分析安全评估框架，完成对芯片物理泄漏与旁路区分器两部分的量化评估，并以互信息和成功率为安全评估指标完成具体实验环境下的量化评估。.（6）针对FPGA加密芯片中后门程序（故障泄露型硬件木马），利用功耗旁路信号，探讨了利用最大间距准则（MMC）对硬件木马进行旁路检测的可行性，并提出了相应的硬件木马检测方案。