University of Michigan

University of Florida Research Foundation, Incorporated

Kevin Fu

Daniel E Holcomb

Kevin R Butler

Peter Honeyman

Timothy Trippel

Pirouz Naghavi

Yan Long

Ofir Weisse

Sara Rampazzi

Rolling shutter and movable lens structures widely found in smartphone cameras modulate structure-borne sounds onto camera images, creating a point-of-view optical-acoustic side channel for acoustic eavesdropping. The movement of smartphone camera hardware leaks acoustic information because images unwittingly modulate ambient sound as imperceptible distortions. Experiments have found that the side channel is further amplified by intrinsic behaviors of complementary metal-oxide-semiconductor (CMOS) rolling shutters and movable lenses such as in optical image stabilization (OIS) and auto focus (AF). This disclosure characterizes the limits of acoustic information leakage caused by structure-borne sound that perturbs the point-of-view of smartphone cameras. In contrast with traditional optical-acoustic eavesdropping on vibrating objects, this side channel requires no line of sight and no object within the camera's field of view.

Acoustic eavesdropping using a smartphone camera

Cyber-physical systems depend on sensors to make automated decisions. Resonant acoustic injection attacks are already known to cause malfunctions by disabling MEMS-based gyroscopes. However, an open question remains on how to move beyond denial of service attacks to achieve full adversarial control of sensor outputs. This work investigates how analog acoustic injection attacks can damage the digital integrity of a popular type of sensor: the capacitive MEMS accelerometer. Spoofing such sensors with intentional acoustic interference enables an out-of-spec pathway for attackers to deliver chosen digital values to microprocessors and embedded systems that blindly trust the unvalidated integrity of sensor outputs. Two software-based solutions are presented for mitigating acoustic interference with output of a MEMS accelerometer and other types of motion sensors.

Protecting motion sensors from acoustic injection attack

A technique is presented for performing a physical unclonable function (PUF) using an array of SRAM cells. The technique can be viewed as an attempt to read multiple cells in a column at the same time, creating contention that is resolved according to process variation. An authentication challenge is issued to the array of SRAM cells by activating two or more wordlines concurrently. The response is simply the value that the SRAM produces from a read operation when the challenge condition is applied. The number of challenges that can be applied the array of SRAM cells grows exponentially with the number of SRAM rows and these challenges can be applied at any time without power cycling.

Physical unclonable function using augmented memory for challenge-response hashing

Growing community of inventors

Ann Arbor, MI, United States of America

Kevin Fu