基于HMM的微控制器旁路模板指令序列恢复

Retrieve Instruction Sequences with Side Channel Template Based on Hidden Markov Model in Microcontroller

针对微控制器代码旁路逆向恢复的问题,采用逆向工程思想与旁路攻击方法,依据不同的指令在芯片内执行时,会产生不同的功耗旁路泄漏信号这一特点,在已实现的单条指令旁路模板恢复的基础上,综合考虑程序的"上下文"信息,运用隐马尔可夫模型(HMM)对该问题进行建模描述与求解.对AT89C52微控制器中运行的数据加密标准(DES)加密算法的部分指令序列的恢复实验表明,该方法能够有效的恢复出微控制器芯片中运行的指令序列.

In order to exploit prior knowledge about the program code, a math model, Hidden Markov Model （HMM）, is applied to describe and resolve a problem of recovering the program code of a mierocontroller. With the idea of reverse engineering and the method of Side-Channel Attacks （SCA）, and according to the property that different power consumption leakage characters for different instructions executed in chips, a practical experiment based on previous side channel templates built by making use of power consumption leakages for each instruction has shown that instruction sequences executed in a Data Encryption Standard （DES） microcontroller （AT89C52） cipher chip circuit can be reconstructed and has confirmed the effectiveness of method mentioned above.