METHOD AND APPARATUS FOR A NEURAL NETWORK

Abstract

A computer-implemented method for a neural network, for example an artificial deep neural network. The method includes: providing a plurality of training data sets, each training data set comprising input data for the neural network and associated output data, training the neural network based on the plurality of training data sets and a loss function, wherein the loss function is based on a bit-wise correlation of an output value provided by the neural network and a predetermined function characterizing an operation of a physical system.

Description

CROSS REFERENCE

The present application claims the benefit under 35 U.S.C. § 119 of European Patent Application No. EP 20201311.6 filed on Oct. 12, 2020, which is expressly incorporated herein by reference in its entirety.

FIELD

The present invention relates to a method for a neural network. The present invention further relates to an apparatus for a neural network.

SUMMARY

Exemplary embodiments of the present invention relate to a method, for example a computer-implemented method, for a neural network, for example an artificial deep neural network (DNN), comprising: providing a plurality of training data sets, each training data set comprising input data for the neural network and associated output data, training the neural network based on the plurality of training data sets and a loss function, wherein the loss function is based on a bit-wise correlation of an output value provided by the neural network and a predetermined function characterizing an operation of a physical system. In some embodiments, this enables to increase a correlation coefficient within a side channel attack (SCA).

According to further exemplary embodiments of the present invention, the providing of the training data sets comprises: determining a plurality of profiling traces, wherein each profiling trace characterizes at least one physical parameter, for example an electrical power consumption, of the physical system during execution of the predetermined function, and determining a respective output value of the predetermined function for each of the plurality of profiling traces, and, optionally, using the profiling traces and the output values as said training data sets.

In some embodiments of the present invention, a profiling trace can, e.g., be characterized by a plurality of measurements of an electrical power consumption of the physical system, e.g., a time series of such measurements, which may, e.g., be represented by a vector.

In some embodiments of the present invention, a respective output value may be obtained from evaluating the predetermined function, which may, e.g., comprise a cryptographic primitive and/or function, such as, e.g., the S-Box (nonlinear substitution) operation according to the Advanced Encryption Standard (AES). As an example, in some embodiments, input data such as, e.g., a plaintext p and a (secret) key k may be used, and the function f(p, k), e.g., the S-Box operation, may be evaluated based on the input data p, k, to obtain the respective output value v=f(p, k).

Note that in some embodiments of the present invention, e.g., for a profiling phase, e.g., for training the DNN, the usually secret key k is known and may be used to determine the output value v. In some embodiments of the present invention, in a further phase, e.g., after the DNN has been trained (profiling phase), the trained DNN may be used to analyze and/or “attack” (e.g., perform side channel analysis) the physical system and/or a similar system, e.g., to determine a secret key used by the physical system. In some embodiments, e.g., during the further (e.g., “attack”) phase, the information represented by the trained DNN may be used to determine the (then) secret key.

According to further exemplary embodiments of the present invention, the neural network is a convolutional neural network, e.g., a neural network providing convolution operations to process data provided to the DNN as input data and/or data derived from the input data.

According to further exemplary embodiments of the present invention, a backpropagation technique is used for the training.

According to further exemplary embodiments of the present invention, the loss function can be characterized by the following equation:

${ℒ}_{\mathrm{CO}-\mathrm{BIT}}\left(l_{\mathrm{bit}},{\theta }_{\mathrm{bit}}\right)=\sum _{i=1}^B{{ℒ}_{\mathrm{CO}}\left(l_{\mathrm{bit}},{\theta }_{\mathrm{bit}}\right)}^{\left(i\right)},$

wherein l_bit characterizes a bit value of a leakage value associated with the predetermined function, wherein θ_bit characterizes a bit value of the output value, wherein i is an index variable, wherein B is a total number of bits, e.g., of the function value, wherein _CO characterizes a correlation loss function, and wherein 1.1 characterizes an absolute value.

According to further exemplary embodiments of the present invention, the correlation loss function can be characterized by the following equation:

${ℒ}_{\mathrm{CO}}\left(l,\theta \right)=1-\frac{\mathrm{cov}\left(l,\theta \right)}{{\sigma }_l{\sigma }_{\theta }+ϵ}=1-\frac{\sum _{i=1}^D\left[\left(l_i-\stackrel{\_}{l}\right)\left({\theta }_i-\stackrel{\_}{\theta }\right)\right]}{\sum _{i=1}^D\left(l_i-\stackrel{\_}{l}\right)\sum _{i=1}^D{\left({\theta }_i-\stackrel{\_}{\theta }\right)}^2+ϵ},$

wherein cov( ) is a covariance, wherein σ_l characterizes the standard deviation of the input vector l, wherein σ_θ characterizes the standard deviation of the input vector θ, wherein D characterizes the batch size (e.g., characterizing a number of, e.g., power traces considered), wherein l characterizes the mean of the input l, wherein θ characterizes the mean of the input θ, wherein ε characterizes a characterizes a non-vanishing, e.g., small, parameter, wherein for example ε=10⁻¹⁴. In some embodiments, the parameter may be used to avoid division by zero in some cases.

According to further exemplary embodiments of the present invention, the method further comprises weighting the bit values l_bit of the leakage value using weighting coefficients, wherein weighted bit values l_{bit_w} are obtained, and performing the correlation based on the weighted bit values l_{bit_w} (“weighted bit leakage”).

In some embodiments of the present invention, a bit-wise correlation may be performed based on the weighted bit values l_{bit_w}.

In some embodiments of the present invention, a non-bit-wise correlation may be performed based on the weighted bit values l_{bit_w}. In other words, in some embodiments, the weighting of the bit values l_bit of the leakage value using weighting coefficients may be performed, and a non-bit-wise correlation may be performed based on a result thereof.

According to further exemplary embodiments of the present invention, using a further neural network, e.g., a perceptron, is provided, to approximate at least some of the weighting coefficients. In some embodiments, the weighting coefficients comprise information on hardware aspects such as, e.g., parasitic capacitance and/or (transmission) line/wire lengths, e.g., between different register cells of the physical system, which may influence, e.g., the electric power consumption.

According to further exemplary embodiments of the present invention, the weighted bit leakage may be characterized by the equation

$l_{\mathrm{CO}-\mathrm{bit}}=\eta +\sum _{i=1}^B{c}_i⨯\left(\mathrm{RQ}\oplus \mathrm{RD}\right)=\eta +\sum _{i=1}^B{c}_i⨯l_{\mathrm{bit}}^i,$

wherein it is assumed that R is a B-bit register with an input RD and a registered output RQ, and wherein η refers to a non-data dependent noise factor.

According to further exemplary embodiments, the method further comprises modifying a design and/or structure of the physical system based on at least one of the approximated weighting coefficients. In some embodiments, this way, asymmetry between different bit lines of the physical system may be reduced, wherein the physical system may be hardened against side channel attacks.

According to further exemplary embodiments of the present invention, the method further comprises using the neural network for determining information on at least one unknown and/or secret parameter of the physical system and/or of a further physical system, which for example is structurally identical with the physical system at least to some extent. In some embodiments, the DNN trained according to the principle of the embodiments may, e.g., be used for side channel attacks (SCA), e.g., based on correlation power analysis (CPA).

Further exemplary embodiments of the present invention relate to an apparatus configured to perform the method according to the embodiments.

Further exemplary embodiments of the present invention relate to a computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out the method according to the embodiments.

Further exemplary embodiments of the present invention relate to a computer-readable storage medium comprising instructions which, when executed by a computer, cause the computer to carry out the method according to the embodiments.

Further exemplary embodiments of the present invention relate to a data carrier signal carrying and/or characterizing the computer program according to the embodiments.

Further exemplary embodiments of the present invention relate to a use of the method according to the embodiments and/or of the apparatus according to the embodiments and/or of the computer program according to the embodiments for at least one of: a) performing a side channel analysis and/or attack on a physical system, b) evaluating a design of a physical system, e.g., regarding its vulnerability to side channel attacks, c) determining a correlation between a predicted output of a physical system and a physical parameter, e.g., power consumption, of the physical system, d) determining secret data, e.g., a secret cryptographic key.

BRIEF DESCRIPTION OF THE DRAWINGS

Some exemplary embodiments will now be described with reference to the figures.

FIG. 1A schematically depicts a simplified flow-chart of a method according to exemplary embodiments of the present invention.

FIG. 1B schematically depicts a simplified flow-chart of a method according to further exemplary embodiments of the present invention.

FIG. 2 schematically depicts a simplified block diagram according to further exemplary embodiments of the present invention.

FIG. 3 schematically depicts a simplified block diagram according to further exemplary embodiments of the present invention.

FIG. 4 schematically depicts a simplified flow-chart of a method according to further exemplary embodiments of the present invention.

FIG. 5 schematically depicts a simplified flow-chart of a method according to further exemplary embodiments of the present invention.

FIG. 6 schematically depicts a simplified flow-chart of a method according to further exemplary embodiments of the present invention.

FIG. 7 schematically depicts a simplified flow-chart of a method according to further exemplary embodiments of the present invention.

FIG. 8 schematically depicts a simplified block diagram according to further exemplary embodiments of the present invention.

FIG. 9 schematically depicts aspects of use according to further exemplary embodiments of the present invention.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

Exemplary embodiments relate to a method, FIG. 1A, 2, for example a computer-implemented method, for a neural network, for example an artificial deep neural network (DNN), comprising: providing 100 a plurality of training data sets TDS, each training data set TDS, see FIG. 2, comprising input data ID for the neural network NN and associated output data OD, training 102 (FIG. 1A) the neural network NN based on the plurality of training data sets TDS and a loss function LF, wherein the loss function LF is based on a bit-wise correlation of an output value OV provided by the neural network NN and a predetermined function F characterizing an operation of a physical system PS, e.g., an electronic system. In some embodiments, the bit-wise correlation enables to increase a correlation coefficient.

According to further exemplary embodiments, the providing 100 of the training data sets TDS comprises, FIG. 1B: determining 100a a plurality of profiling traces x_i, wherein each profiling trace x_i characterizes at least one physical parameter, for example an electrical power consumption, of the physical system PS (FIG. 2) during execution of the predetermined function F, and determining 100b a respective output value v_i of the predetermined function F for each of the plurality of profiling traces x_i, and, optionally, using 100c the profiling traces x_i and the output values v_i as said training data sets TDS.

In some embodiments, the training data sets TDS may be characterized by D_Train={x_i,v_i}, with i=1, . . . , N_profiling, wherein N_Profiling characterizes a number of the training data sets TDS.

In some embodiments, a profiling trace x_i can, e.g., be characterized by a plurality of measurements of an electrical power consumption of the physical system PS, e.g., a time series of such measurements, which may, e.g., be represented by a vector x_i. In some embodiments, the physical system PS may be or comprise an electronic device, e.g., an electronic device configured to perform cryptographic functions.

In some embodiments, a respective output value v_i may be obtained from evaluating the predetermined function F, which may, e.g., comprise a cryptographic primitive and/or function, such as, e.g., the S-Box (nonlinear substitution) operation according to the Advanced Encryption Standard (AES). As an example, in some embodiments, input data such as, e.g., a plaintext p and a (secret) key k may be used, and the function f(p, k) (exemplarily symbolized by reference sign “F” in FIG. 2), e.g., the S-Box operation, may be evaluated based on the input data p, k, to obtain the respective output value v=f(p, k).

Note that in some embodiments, e.g., for a profiling phase, e.g., for training the DNN, the—usually secret—key k is known and may be used to determine the output value v. In some embodiments, in a further phase, e.g., after the DNN NN has been trained, e.g., during the profiling phase, the trained DNN may be used to analyze and/or “attack” (e.g., perform side channel analysis) the physical system PS and/or a similar system PS' (see FIG. 7), e.g., to determine a secret key used by the physical system PS′. In some embodiments, e.g., during the further (e.g., “attack”) phase, the information represented by the trained DNN may be used to determine the (then) secret key.

According to further exemplary embodiments, the neural network NN (FIG. 2) is a convolutional neural network (CNN), e.g., a neural network providing convolution operations to process data provided to the DNN as input data and/or data derived from the input data. In some embodiments, the neural network NN may comprise a multi-layer perceptron (MLP).

FIG. 3 exemplarily depicts a simplified block diagram of a possible network topology NN-1 for the DNN NN of FIG. 2. The DNN NN comprises an input layer IL with a first number of processing elements (only one of which is denoted with reference sign PE in FIG. 3 for the sake of clarity), an output layer OL (presently comprising a single processing element, and two intermediate or hidden layers HL1, HL2.

In some embodiments, a number of processing elements PE of the input layer IL may, e.g., correspond with the number of power consumption measurement values of a profiling trace x_i, wherein, e.g., each processing element PE of the input layer IL is configured to process one power consumption measurement value of the profiling trace x_i.

In some embodiments, the processing element of the output layer OL may be configured to output a floating point number as output value OV, e.g., characterizing an encoding. In other words, in some embodiments, the DNN NN may be used as an encode network that determines the output value OV based on the input data, e.g., power traces of the physical system PS.

In some embodiments, at least some of the layers IL, HL1, HL2, OL may be fully connected, as exemplarily depicted by FIG. 3. In some embodiments, other connection topologies may be provided.

According to further exemplary embodiments, a backpropagation technique is used for the training 102 (FIG. 1A).

According to further exemplary embodiments, the loss function e.g., used for backpropagation can be characterized by the following equation:

$\begin{array}{cc}{ℒ}_{\mathrm{CO}-\mathrm{BIT}}\left(l_{\mathrm{bit}},{\theta }_{\mathrm{bit}}\right)=\sum _{i=1}^B{{ℒ}_{\mathrm{CO}}\left(l_{\mathrm{bit}},{\theta }_{\mathrm{bit}}\right)}^{\left(i\right)},& \left(\mathrm{equation}1\right)\end{array}$

wherein l_bit characterizes a bit value of a leakage value associated with the predetermined function F (FIG. 2), wherein θ_bit characterizes a bit value of the output value OV, wherein i is an index variable, wherein B is a total number of bits, e.g., of the function value OV, wherein _CO characterizes a correlation loss function, and wherein 1.1 characterizes an absolute value.

As can be seen, in some embodiments, the loss function is evaluated in a bit-wise manner, e.g., processing, by means of the

sum

$\sum _{i=1}^B{{ℒ}_{\mathrm{CO}}\left(l_{\mathrm{bit}},{\theta }_{\mathrm{bit}}\right)}^{\left(i\right)},$

corresponding single bits of the output value OV (represented by θ in the above equation) and of the leakage value l (corresponding with the output value v_i of the function F) each. In other words, in some embodiments, the correlation loss function _CO is provided with respective single bit values l_bit, θ_bit, evaluated with these two input bits, and after that an absolute value of the respective value of the correlation loss function _LO is obtained, wherein this procedure is repeated B many times, adding the individual absolute values of the bit-wise evaluated correlation loss function _CO.

According to further exemplary embodiments, the correlation loss function _CO can be characterized by the following equation:

$\begin{array}{cc}{ℒ}_{\mathrm{CO}}\left(l,\theta \right)=1-\frac{\mathrm{cov}\left(l,\theta \right)}{{\sigma }_l{\sigma }_{\theta }+ϵ}=1-\frac{\sum _{i=1}^D\left[\left(l_i-\stackrel{\_}{l}\right)\left({\theta }_i-\stackrel{\_}{\theta }\right)\right]}{\sum _{i=1}^D\left(l_i-\stackrel{\_}{l}\right)\sum _{i=1}^D{\left({\theta }_i-\stackrel{\_}{\theta }\right)}^2+ϵ},& \left(\mathrm{equation}2\right)\end{array}$

wherein cov( ) is a covariance, wherein σ_l characterizes the standard deviation of the input vector l, wherein σ_σ characterizes the standard deviation of the input vector θ, wherein D characterizes the batch size, wherein l characterizes the mean of the input l, wherein θ characterizes the mean of the input θ, wherein ε characterizes a characterizes a non-vanishing, e.g., small, parameter, wherein for example ε=10⁻¹⁴. In some embodiments, the parameter may be used to avoid division by zero in some cases.

According to further exemplary embodiments, FIG. 4, the method further comprises weighting 110 the bit values l_bit of the leakage value using weighting coefficients c_i, wherein weighted bit values l_{bit_w} are obtained, and performing 112 the (optionally bit-wise) correlation based on the weighted bit values l_{bit_w}.

Note that in some embodiments, a bit-wise correlation may be performed based on the weighted bit values l_{bit_w}. Also, note that in some (other) embodiments, a non-bit-wise correlation may be performed based on the weighted bit values l_{bit_w}.

According to further exemplary embodiments, as shown in FIG. 4, using 105 a further (e.g., artificial) neural network, e.g., a perceptron, is provided, to approximate at least some of the weighting coefficients c_i. In some embodiments, the weighting coefficients c_i comprise information on hardware aspects such as, e.g., parasitic capacitance and/or (transmission) line/wire lengths, e.g., between different register cells of the physical system PS (FIG. 2), which may influence, e.g., the electric power consumption.

According to further exemplary embodiments, the method further comprises modifying 106 a design and/or structure of the physical system PS based on at least one of the approximated weighting coefficients. In some embodiments, this way, e.g., asymmetry between different bit lines of the physical system PS may be reduced, wherein the physical system PS may be hardened against side channel attacks.

According to further exemplary embodiments, the method further comprises using 104 (FIG. 1A) the neural network NN, e.g., the trained NN DNN as may be obtained by the training 102 according to some embodiments, for determining information on at least one unknown and/or secret parameter (e.g., cryptographic key) k of the physical system PS and/or of a further physical system PS′ (FIG. 7), which for example is structurally identical with the physical system PS at least to some extent. In some embodiments, the DNN NN trained according to the principle of the embodiments may, e.g., be used for side channel attacks (SCA), e.g., based on correlation power analysis (CPA).

FIG. 5 schematically depicts a simplified flow-chart of a method according to further exemplary embodiments. In some embodiments, the configuration of FIG. 5 may, e.g., be used for a correlation optimization using a bitwise loss calculation, e.g., for the training 102 of the DNN NN. Reference sign x denotes an exemplary power or electromagnetic (EM) trace, e.g., a time series of power consumption (or EM emission) measurements, e.g., of the physical system PS (FIG. 2), which is provided to the DNN NN. Based on this input data x, the DNN NN provides an output value OV (e.g., a float or double number), individual bits of which are denoted with θ_bit¹, θ_bit², . . . , θ_bit^B. Presently, the output value OV exemplarily comprises B many bits. In some embodiments, an output value of the function F, e.g., f(p, k), is determined, and provided in form of its bits l_bit¹, l_bit², . . . , l_bit^B, e.g., via the optional “bit conversion” block BC. In some embodiments, a bit-wise correlation, e.g., using equation (1) as explained above, is performed, see block COR of FIG. 5.

FIG. 6 schematically depicts a simplified flow-chart of a method according to further exemplary embodiments. In some embodiments, the configuration of FIG. 6 may, e.g., be used for a correlation optimization using a bitwise loss calculation, e.g., for the training 102 of the DNN NN, similar to FIG. 5. Different from FIG. 5, the configuration of FIG. 6 comprises a further neural network fNN, e.g., of the perceptron type, wherein the further neural network fNN is configured to receive the bits l_bit¹, l_bit², . . . , l_bit^B and to perform a weighting by means of the weighting coefficients c₁, c₂, c_n, also see, e.g., block 110 of FIG. 4. Correspondingly, in some embodiments, the correlation COR of FIG. 6 is based on the weighted bits l_{bit_w}.

FIG. 7 schematically depicts a simplified block diagram according to further exemplary embodiments. Element e1 symbolizes a physical system PS which may also be denoted as “profiling device”, as it may be used for a profiling phase according to some embodiments. In some embodiments, the profiling device PS may, e.g., be used for Deep Learning (DL)-based profiled SCA, e.g., using correlation optimization (CO). As an example, in the profiling phase, one can take advantage of a profiling device PS on which the input p and secret key k (e.g., parameters of a cryptographic function evaluated by the device PS) can be fully controlled. In some embodiments, the profiling device PS is used to acquire a plurality, e.g., a large number, of profiling traces x_i to build the training data set D_Train, which in turn is used to train (see for example block 102 of FIG. 1A) a DNN NN (FIG. 2), e.g., using the CO loss as may, e.g., be characterized by equation 1.

Element e2 symbolizes measurement equipment which may, e.g., be used to determine the profiling traces in some embodiments. Element e3 exemplarily symbolizes graphically a profiling trace forming part of the training data set D_Train. Element e4 symbolizes the training data set TDS that may be used for training 102, and element e5 symbolizes the neural network NN, e.g., during a training phase. Element e6 symbolizes an optional CPA that may be performed using the trained neural network NN in some embodiments.

In some embodiments, during an attack phase, a (new) set of attack traces D_Attack may be obtained by operating an actual target device PS′, e.g., a physical system which is structurally identical or similar to the profiling device PS, whereby the secret key k is, e.g., fixed and unknown. Element e7 symbolizes the target device, and element e8 symbolizes measurement equipment which may, e.g., be used to determine the attack traces in some embodiments, similar to element e2. Element e9 symbolizes an exemplary attack trace, and element e10 symbolizes the set of attack traces D_Attack.

The secret key k of the target device PS′ may in some embodiments be determined or recovered by applying a CPA e6, wherein the attack traces D_Attack are, e.g., encoded by the DNN NN, e5 that was trained in the profiling phase.

In some embodiments, after a profiling phase, the DNN outputs (encoded traces+optimized leakage) may, e.g., be used as an input for a template attack (TA) or to train a simple (linear) classifier such as logistic regression.

Further exemplary embodiments, as shown in FIG. 8, relate to an apparatus 200 configured to perform the method according to the embodiments.

The apparatus 200 comprises at least one calculating unit 202 and at least one memory unit 204 associated with (i.e., usably by) said at least one calculating unit 202 for at least temporarily storing a computer program PRG and/or data DAT, wherein said computer program PRG is, e.g., configured to at least temporarily control an operation of said apparatus 200, e.g., the execution of a method according to the embodiments, cf., e.g., the exemplary flow chart of FIG. 1A.

In some embodiments, said at least one calculating unit 202 comprises at least one core 202a, 202b, 202c for executing said computer program PRG or at least parts thereof, e.g., for executing the method according to the embodiments or at least one or more steps thereof.

According to further preferred embodiments, the at least one calculating unit 202 may comprise at least one of the following elements: a microprocessor, a microcontroller, a digital signal processor (DSP), a programmable logic element (e.g., FPGA, field programmable gate array), an ASIC (application specific integrated circuit), hardware circuitry, a tensor processor, a graphics processing unit (GPU). According to further preferred embodiments, any combination of two or more of these elements is also possible.

According to further preferred embodiments, the memory unit 204 comprises at least one of the following elements: a volatile memory 204a, particularly a random-access memory (RAM), a non-volatile memory 204b, particularly a Flash-EEPROM. Preferably, said computer program PRG is at least temporarily stored in said non-volatile memory 204b. Data DAT, which may, e.g., be used for executing the method according to the embodiments, may at least temporarily be stored in said RAM 204a.

According to further preferred embodiments, an optional computer-readable storage medium SM comprising instructions, e.g., in the form of a computer program PRG, may be provided, wherein said computer program PRG, when executed by a computer, i.e., by the calculating unit 202, may cause the computer 202 to carry out the method according to the embodiments. As an example, said storage medium SM may comprise or represent a digital storage medium such as a semiconductor memory device (e.g., solid state drive, SSD) and/or a magnetic storage medium such as a disk or hard disk drive (HDD) and/or an optical storage medium such as a compact disc (CD) or DVD (digital versatile disc) or the like.

According to further preferred embodiments, the apparatus 200 may comprise an optional data interface 206, preferably for bidirectional data exchange with an external device (not shown). As an example, by means of said data interface 206, a data carrier signal DCS may be received, e.g., from said external device, for example via a wired or a wireless data transmission medium, e.g., over a (virtual) private computer network and/or a public computer network such as, e.g., the Internet. According to further preferred embodiments, the data carrier signal DCS may represent or carry the computer program PRG according to the embodiments, or at least a part thereof.

In some embodiments, the apparatus 200 may receive profiling traces x_i and/or attack traces and/or other data v_i via the data carrier signal DCS.

Further exemplary embodiments relate to a computer program PRG comprising instructions which, when the program is executed by a computer 202, cause the computer 202 to carry out the method according to the embodiments.

Further exemplary embodiments, as shown in FIG. 9, relate to a use 300 of the method according to the embodiments and/or of the apparatus according to the embodiments and/or of the computer program according to the embodiments for at least one of: a) performing 301 a side channel analysis and/or attack on a physical system PS, PS′, b) evaluating 302 a design of a physical system PS, PS′, e.g., regarding its vulnerability to side channel attacks, c) determining 303 a correlation between a predicted output of a physical system and a physical parameter, e.g., power consumption, of the physical system, d) determining 304 secret data, e.g., a secret cryptographic key k.

The principle of the embodiments may, e.g., be used for Power-based Side-Channel Attacks (SCAs), e.g., against security enabled devices. Power-based SCA exploit information leakages gained from a power consumption or electromagnetic emanations of a device to extract secret information such as cryptographic keys, even though the employed algorithms are mathematically sound.

SCAs can be divided in two categories: Non-profiled SCAs techniques aim to recover the secret key k by performing statistical calculations on power measurements of the device under attack regarding a hypothesis of the device's leakage. Profiled SCAs assume a stronger adversary who is in possession of a profiling device. It is an open copy of the attacked device which the adversary can manipulate to characterize the leakages very precisely in a first step. Once this has been done, the built model can be used to attack the actual target device in the key extraction phase.

In some embodiments, the DNN NN is trained to learn an encoding of the input data (e.g., power traces and/or electromagnetic parameters or the like) that maximizes a Pearson correlation with a hypothetical power consumption (aka leakage).

Some embodiments provide improvements of a CO scheme, wherein the first aspect is based on the bitwise DNN loss function calculation. A second aspect uses an additional (e.g., small) DNN fNN (FIG. 6), e.g., to learn an optimized power consumption model (that can be characterized based on the weighting coefficients c_i) to improve the correlation coefficient. In some embodiments, both aspects can be especially useful in the context of cryptographic hardware accelerators 202.

Claims

1. A computer-implemented method for a neural network, comprising the following steps: providing a plurality of training data sets, each training data set of the plurality of training data sets including input data for the neural network and associated output data;training the neural network based on the plurality of training data sets and a loss function, wherein the loss function is based on a bit-wise correlation of an output value provided by the neural network and a predetermined function characterizing an operation of a physical system.

2. The method according to claim 1, wherein the neural network is an artificial deep neural network.

3. The method according to claim 1, wherein the providing of the training data sets includes: determining a plurality of profiling traces, wherein each profiling trace of the plurality of profiling traces characterizes at least one physical parameter of the physical system during execution of the predetermined function; anddetermining a respective output value of the predetermined function for each of the plurality of profiling traces.

4. The method according to claim 3, wherein the each profiling trace characterizes an electric power consumption of the physical system.

5. The method according claim 3, further comprising: using the profiling traces and the output values as the training data sets.

6. The method according to claim 1, wherein the neural network is a convolutional neural network.

7. The method according to claim 1, wherein a backpropagation technique is used for the training.

8. The according to claim 1, wherein the loss function is characterized by the following equation:

9. σlσθlθThe method according to claim 8, wherein the correlation loss function is characterized by the following equation:

10. The method according to claim 9, wherein ε=10−14.

11. The method according to claim 8, further comprising: weighting the bit values lbit of the leakage value using weighting coefficients, wherein weighted bit values lbit_w are obtained; andperforming the correlation based on the weighted bit values lbit_w.

12. The method according to claim 11, further comprising: using a further neural network to approximate at least some of the weighting coefficients.

13. The method according to claim 12, wherein the further neural network is a perceptron.

14. The method according to claim 12, further comprising: modifying a configuration and/or structure of the physical system based on at least one of the approximated weighting coefficients.

15. The method according to claim 1, further comprising: using the neural network for determining information on at least one unknown and/or secret parameter of the physical system.

16. The method according to claim 1, further comprising: using the neural network for determining information on at least one unknown and/or secret parameter of a further physical system which is structurally identical with the physical system at least to some extent.

17. An apparatus configured for a neural network, the apparatus configured to: provide a plurality of training data sets, each training data set of the plurality of training data sets including input data for the neural network and associated output data;train the neural network based on the plurality of training data sets and a loss function, wherein the loss function is based on a bit-wise correlation of an output value provided by the neural network and a predetermined function characterizing an operation of a physical system.

18. A non-transitory computer-readable storage medium on which are stored instructions for a neural network, the instructions, when executed by a computer, causing the computer to perform the following steps: providing a plurality of training data sets, each training data set of the plurality of training data sets including input data for the neural network and associated output data;training the neural network based on the plurality of training data sets and a loss function, wherein the loss function is based on a bit-wise correlation of an output value provided by the neural network and a predetermined function characterizing an operation of a physical system.

19. The method according to claim 1, further comprising at least one of the following: a) performing a side channel analysis and/or attack on the physical system,b) evaluating a design of the physical system regarding its vulnerability to side channel attacks,c) determining a correlation between a predicted output of the physical system and a physical parameter of the physical system,d) determining secret data.

20. The method as recited in claim 15, wherein the physical parameter is a power consumption of the physical system.

21. The method as recited in claim 15, wherein the secret data is a secret cryptographic key.