Upload
others
View
8
Download
0
Embed Size (px)
Citation preview
Support Vector Regression: ExploitingMachine Learning Techniques for Leakage
Modeling
Dirmanto Jap 1 Marc Stottinger 2 Shivam Bhasin 2
1School of Physical and Mathematical Sciences, Nanyang TechnologicalUniversity, Singapore
2Temasek Laboratories at Nanyang Technological University, Singapore
14 June 2015
1 / 28
Outline
• Introduction
• Background
• Methods
• Experiments
• Conclusion
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 2 / 28
Introduction
• Side-channel analysis exploits physical leakage of thecryptographic device
• It has two main components, leakage modeling anddistinguisher
• More research efforts have been focused on distinguisher
• Leakage is mainly modeled with Hamming weight, Hammingdistance, bitwise, etc
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 3 / 28
Introduction
TA
Attacked circuit
EMASPA, DPA, templates, etc.
Time
⇒ Side-channel trace
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 4 / 28
Introduction
.
.
.
.
.
.
.
.
.
. .
.
.
.
.
.
.
.
.
.
....
Mutual Information
Statistical Test: Distinguisher
Hamming Distance
Maximum Likelihood
Hamming Weight
H1,2
H1,3
H1,N HK,N
H1,1 HK,1
HK,2
HK,3
H2,1
H2,2
H2,N
H2,3
L1
L2
L3
LN
?
NInputs
N inputs
Leakage Modeling
Correlation
K Key hypothesis
Key Hypothesis
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 5 / 28
Side-Channel Analysis
• Side-channel analysis can be mainly classified into profilingand non-profiling based attacks
• In non-profiling attacks, the attacker tries to exploit statisticaldependency (i.e., Correlation Power Analysis, MutualInformation Analysis)
• In profiling attacks, the attacker’s goal is to characterize thedevice (i.e., Template Attacks, Stochastic Approach)
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 6 / 28
Background
• The side-channel leakage can be mainly decomposed into thedeterministic part and the randomized part
• Given the plaintext (x) and the key (k), the leakage forintermediate value IVx,k = f(x, k) is given by:
Tx,k = L(f(x, k)) + ε,
• L is the leakage function that maps the intermediate value toits side-channel leakage Tx,k and ε is the (assumed) mean freeGaussian noise (ε ∼ N(0, σ2))
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 7 / 28
Profiling Based Attacks
• These attacks are considered as the strongest attacks
• However, this is based on the assumption that the profile isbuilt correctly
• It could be either by classification (i.e., TA) or by regression(i.e., SA)
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 8 / 28
Classical Profiling Attack
• Template Attacks (TA)• A template is constructed for each intermediate value• The template consists of the pair (µ,Σ)
• Stochastic Approach (SA)• The deterministic part of the leakage is determined using linear
regression based on the subspace representation of theintermediate value
• Different subspace are for example: F2 which uses HW or HD,F9 which is bitwise representation, and F256 which is similar togeneric template model
• Only one noise covariance matrix is used
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 9 / 28
Machine Learning in Side-Channel Analysis
• Machine learning has been adopted for profiling attacks
• It is used mainly for a leakage characterization or adistinguisher
• Previous works have shown some promising results
• Commonly used learning algorithms include Support VectorMachine (SVM) and Random Forest (RF)
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 10 / 28
Support Vector Machine
• SVM have been compared with TA under different attackscenarios
• It is shown to be more robust against noise and requires lessattack traces
• It is used for classification, based on separating hyperplane
• It uses soft margin to deal with non-separable data and kerneltrick to deal with non-linearity issue
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 11 / 28
Support Vector Machine
−0.8 −0.6 −0.4 −0.2 0 0.2 0.4 0.6 0.8
−0.8
−0.6
−0.4
−0.2
0
0.2
0.4
0.6
0.8
x
y
(a) SVM on original data (b) Mapping to higher dimension
Figure : How SVM performs linear classification on non-linear data, bymapping it to higher dimension space.
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 12 / 28
Support Vector Machine
• φ(t): transformation into higher dimension, might beimpractical
• Primal form
arg minw,b,ξ
1
2‖w‖2 + C
N∑i=1
ξi ,s.t: ci(〈w,φ(ti)〉+ b) ≥ 1− ξi
• K(ti, tj) = 〈φ(ti), φ(tj)〉, can be expressed as
Kernel name Kernel function
Linear K(ti, tj) = tiT tj
Radial basis function K(ti, tj) = exp(γ‖ti − tj‖2)Polynomial K(ti, tj) = (ti · tj)d
• Dual form
arg maxαi≥0
∑i
αi −1
2
∑j,k
αjαkcjckK(tj, tk),
s.t: αi ≤ C,∑i
αici = 0D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 13 / 28
Support Vector Regression
• The concept is based on support vectors like in SVM, but usesthem for soft margins in the regression process instead ofclassification
• Additional parameter, ε, is required, to compute the lossfunction
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 14 / 28
Support Vector Regression
The problem in SVR is to determine L(~a) = 〈~w, φ(~a)〉+ b, where|L(~a)− t| ≤ ε, which could be formulated as:
arg minw,b
1
2‖~w‖2 + C
N∑i=1
(ξi + ξ∗i )
subject to:ti − 〈~w, φ(~ai)〉 − b ≤ ε+ ξi
〈~w, φ(~ai)〉+ b− ti ≥ ε+ ξ∗i
ξi, ξ∗i ≥ 0
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 15 / 28
Support Vector Regression
−2.5 −2 −1.5 −1 −0.5−1.6
−1.4
−1.2
−1
−0.8
−0.6
−0.4
−0.2
Figure : SVR on non-linear data, the dash line indicates the ε tube(L± ε)
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 16 / 28
Support Vector Regression
• The method is done in similar manner like SA
• Replace the linear regression with SVR during the modelbuilding process to describe the deterministic part of theleakage
• To deal with parameter tuning, the heuristic method fromCherassky and Ma1 is used
1V. Cherkassky and Y. Ma. Practical selection of SVM parameters and noise estimation for SVM
regression. Neural Networks, 17(1):113-126, 2004
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 17 / 28
Experiments
• The experiment was done on forward AES implementationrunning on a standard 8-Bit µC implementation
• Exploit the power side-channel leakage from the first roundSbox output
• This is the most common target for SCA, due to its non-linearproperty.
• Guessing entropy is used as comparison metric
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 18 / 28
Evaluating the Quality of Leakage Modeling UsingCPA
• To compare the quality of the model, Correlation PowerAnalysis (CPA) is used
• A set of 50000 traces from AES implementation are used
• The traces are used to estimate model using SA with F9
(basic), denoted SA9 as well as F256 (maximum), denotedSA256, compared with SVR
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 19 / 28
Evaluating the Quality of Leakage Modeling UsingCPA
3542 3543 3544 3545 3546 3547 35480.8
0.82
0.84
0.86
0.88
0.9
0.92
Point in Time
Correlation
HWSA9SA256SVR
Figure : CPA of different leakage model
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 20 / 28
Evaluation of Attack on Noisy Traces
• The noise was simulated by adding white Gaussian noise tothe captured power traces
• Using 50K power traces, additional sets with an artificial noisemargins generated with standard deviation σ of the µC powertraces: 2.5 σ (SNR 30 dB) and 8 σ (SNR 20 dB)
• Fix training set 40K and the remaining 10K was used for theevaluation of the attack
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 21 / 28
Evaluation of Attack on Noisy Traces
0 5 10 150
10
20
30
40
50
60
70
no. of attack traces
gues
sing
ent
ropy
SATASVRSVRLSVMSVML
(a) SNR 30dB
0 10 20 30 40 500
20
40
60
80
100
120
no. of attack traces
gues
sing
ent
ropy
SATASVRSVRLSVMSVML
(b) SNR 20dB
Figure : Guessing entropy for different noise level
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 22 / 28
Evaluation of Attack on Different Subspaces
• Investigate inter-bit dependent leakage
• The experiment for SA is done using different subspaces (SAiuses Fi subspace)
• For SVR, only 8-bit dimensional model is used
• The experiments are done using original traces and simulatedtraces
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 23 / 28
Evaluation of Attack on Different Subspaces
1 2 3 4 50
2
4
6
8
10
12
14
Attack Traces
Gue
ssin
g en
trop
y
SA9SA37SA93SA163SA219SA247SA255SA256SVR
Figure : Comparison of different subspaces
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 24 / 28
Evaluation of Attack on Different Subspaces
1 2 3 4 5 6 70
5
10
15
20
25
30
35
40
Attack Traces
Gue
ssin
g en
trop
y
SA9SA37SA93SA163SA219SA247SA255SA256SVR
(a) with equal additional coeffi-cients
1 2 3 4 5 6 70
10
20
30
40
50
60
Attack Traces
Gue
ssin
g en
trop
y
SA9SA37SA93SA163SA219SA247SA255SA256SVR
(b) with irregular additional coeffi-cients
Figure : Guessing entropy on simulated data
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 25 / 28
Discussion
• The kernel trick of SVR can be used to generalize the leakagemodel
• When the noise level is low, SVR could perform better thanSA with lower subspace, and approach the performance ofSA256
• When moderate level of noise is present, the performance ofSVR based profiling attacks is comparable with SA
• However, there could be a possibility of overfitting when thenoise level is high
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 26 / 28
Conclusion
• We applied new machine learning based method for profilingbased attacks
• The proposed method can construct good leakage model
• In the future, we will investigate the effectiveness on differentplatforms
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 27 / 28
Thank you!Any questions?
D. Jap, M. Stottinger and S.Bhasin Leakage Modeling with Support Vector Regression 28 / 28