# A Novel Encryption Scheme in Ship Remote Control against Differential Fault Attack
## 3 Prevention of DFA
### Differential Distribution Table  
According to Section 2.2, the key of DFA is to recover the input information of S-box by using the differential distribution table of S-box combined with \(\triangle a_{i,j}\) and \(\triangle b_{i,j}\) indirectly obtained, and then the round key and encryption key can be recovered. However, this sensitive information can be directly obtained from the ciphertext difference and the differential distribution table of original S-box is public. This paper designs a prevention scheme of DFA based on the concept of \"defense in depth strategy\" [18]. That is, generating new S-boxes dynamically based on WGAN-GP to confuse the differential distribution table of SM4 to prevent DFA in the phase of encryption component, and then designing an optimization scheme to prevent DFA in the phase of principle of algorithm. The S-box of SM4 algorithm is an encryption component that functions to add confusion. It can be regarded as a vector Boolean function with input of m bits and output of m bits, i.e., \(S:F_{2}^{m}\to F_{2}^{m},X\to Y=S(X)\). The cryptographic characteristics of S-box reflect its ability to ensure data security in the application of the encryption algorithm. To solve the DFA of the ship shore communication data of intelligent ships, this paper replaces the S-box to dynamically change the differential distribution table. However, the number of S-boxes with excellent cryptographic characteristics is limited and difficult to generate. At present, the proposed S-box generation methods include: generate based on random replacement [19; 20] and generate using chaotic systems [21]. The former has good randomness, but it cannot guarantee the cryptographic characteristics of S-boxes, and it is easy to produce weak S-boxes with low security. The latter takes advantage of the good key sensitivity of the chaotic system, but it requires a lot of floating-point operations and discretization processing in the production process. It will be limited by hardware performance. Weak S-boxes may still be generated. In this paper, we generate S-boxes by using WGAN-GP, and generate similar S-boxes by learning the distribution of excellent S-boxes. Generative Adversarial Network (GAN) is a new framework for estimating the generation model through the confrontation process proposed by [PERSON] and others in 2014 in Generative adversarial networks [22]. The framework of the original GAN theory includes two models, Generator (G) and Discriminator (D), which achieve Nash equilibrium through cross training and then output generated pictures. Because the loss function in the original GAN is JS divergence, the output of the generator overlaps very little with the distribution of the S-box. It cannot reflect the distance between the two distributions, resulting in the disappearance of the gradient. Therefore, the WGAN-GP model with Wasserstein distance and gradient penalty is used in this paper [23]. Its objective function is:  
\[L=E_{\hat{x}\sim P_{g}}[D(\hat{x})]-E_{\sim P_{g}}[D(x)]+\lambda E_{\hat{x}\sim P _{\hat{x}}}[(\|\
abla_{\hat{x}}D(\hat{x})\|_{2}-1)^{2}] \tag{7}\]  
In this paper, we refer to another reference [24] to affine transform the S-box [10] of SM4 algorithm to get a new S-box (recorded as \(S^{\prime}\)), which is \(S^{\prime}(X)=(A\times Y)\oplus C\), to get the training data set, where \(A\) is an affine matrix and \(C\) is a constant vector. The cryptographic indexes of the S-box generated by affine transform are not affected by affine transform, and have good cryptographic characteristics, which is suitable for use as the training data set of WGAN-GP. In terms of the adjustment and use of WGAN-GP, this paper attempts to use one-dimensional and two-dimensional deconvolution and convolution as the internal network of generator and discriminator for training and comparison. In the early stage, we regarded the S-box as a sequence of 256 bits and trained it by GAN with one-dimensional convolution and deconvolution structure.