CamPUF: physically unclonable function based on CMOS image sensor fixed pattern noise

ABSTRACT

Physically unclonable functions (PUFs) have proved to be an effective measure for secure device authentication and key generation. We propose a novel PUF design, named CamPUF, based on commercial off-the-shelf CMOS image sensors, which are ubiquitously available in almost all mobile devices. The inherent process mismatch between pixel sensors and readout circuits in an image sensor manifests as unique fixed pattern noise (FPN) in the image. We exploit FPN caused by dark signal non-uniformity (DSNU) as the basis for implementing the PUF. DSNU can be extracted only from dark images that are not shared with others, and only the legitimate user can obtain it with full control of the image sensor. Compared to other FPN components that can be extracted from shared images, DSNU facilitates more secure and usable device authentication. We present an efficient and reliable key generation procedure for use in wireless low-power devices. We implement CamPUF on Google Nexus 5X and Nexus 5 and evaluate the uniqueness and robustness of the keys, as well as its security against counterfeiting. We demonstrate that it discriminates legitimate and illegitimate authentication attempts without confusion.

References

1. E. J. Alles et al. 2009. Source Camera Identification for Heavily JPEG Compressed Low Resolution Still Images. Journal of Forensic Sciences 54, 3 (2009).
2. Y. Cao et al. 2015. CMOS Image Sensor Based Physical Unclonable Function for Coherent Sensor-Level Authentication. IEEE Trans. on Circuits and Systems I 62, 11 (2015).
3. A. El Gamal and H. Eltoukhy. 2005. CMOS Image Sensors. IEEE Circuits and Devices Magazine 21, 3 (2005).
4. B. Gassend et al. 2002. Silicon Physical Random Functions. In Proc. ACM CCS.
5. S. Kairam et al. 2016. Snap Decisions?: How Users, Content, and Aesthetics Interact to Shape Photo Sharing Behaviors. In Proc. CHI.
6. S. Katzenbeisser et al. 2012. PUFs: Myth, Fact or Busted? A Security Evaluation of Physically Unclonable Functions (PUFs) Cast in Silicon. In Proc. CHES.
7. S. C. Kim et al. 2016. Biometrics for Electronic Eyes: System Authentication with Embedded CMOS Image Sensor. IEEE Trans. on Consumer Electronics 62, 3 (2016).
8. J. Leung et al. 2007. Quantitative Analysis of In-Field Defects in Image Sensor Arrays. In Proc. DFT.
9. L. Lin et al. 2010. Low-Power Sub-Threshold Design of Secure Physical Unclonable Functions. In Proc. ISLPED.
10. M. Liu et al. 2017. A Data Remanence Based Approach to Generate 100% Stable Keys from an SRAM Physical Unclonable Function. In Proc. ISLPED.
11. J. Lukáš et al. 2006. Detecting Digital Image Forgeries using Sensor Pattern Noise. Proc. SPIE 6072 (2006).
12. J. Lukáš et al. 2006. Digital Camera Identification from Sensor Pattern Noise. IEEE Trans. on Information Forensics and Security 1, 2 (2006).
13. Roel Maes et al. 2009. Low-Overhead Implementation of a Soft Decision Helper Data Algorithm for SRAM PUFs. In Proc. CHES.
14. A. Maiti et al. 2010. A Large Scale Characterization of RO-PUF. In Proc. HOST.
15. W. C. Porter et al. 2008. Dark current measurements in a CMOS imager. Proc. SPIE 6816 (2008).
16. E. Quiring and M. Kirchner. 2015. Fragile Sensor Fingerprint Camera Identification. In Proc. WIFS.
17. M. T. Rahman et al. 2014. ARO-PUF: An Aging-Resistant Ring Oscillator PUF Design. In Proc. DATE.
18. G. E. Suh and S. Devadas. 2007. Physical Unclonable Functions for Device Authentication and Secret Key Generation. In Proc. DAC.
19. F. Tehranipoor et al. 2017. DRAM-Based Intrinsic Physically Unclonable Functions for System-Level Security and Authentication. IEEE Trans. on Very Large Scale Integration Systems 25, 3 (2017).
20. D. Valsesia et al. 2017. User Authentication via PRNU-Based Physical Unclonable Functions. IEEE Trans. on Information Forensics and Security 12, 8 (2017).

Index Terms

• Computer systems organization

  • Embedded and cyber-physical systems

    • Sensors and actuators

• Security and privacy

  • Security in hardware

    • Embedded systems security

  • Security services

    • Authentication

      • Multi-factor authentication