HAS your bank recently sent you a credit or debit card with a chip in it? If so, you may now be in possession of a little piece of tech that is quietly helping to secure the ever-expanding realm of internet-connected devices 鈥� which, yes, includes your card.
At least one US bank has started supplying its customers with cards that contain what is known as a physically unclonable function 鈥� or, more snappily, a PUF. Every silicon-based chip gets this unique fingerprint from the way it is manufactured, and it is almost impossible to replicate.
鈥淚t鈥檚 a biometric in a way,鈥� says Boris Kennes at Intrinsic-ID in Eindhoven, the Netherlands. 鈥淓ach chip is born with unique characteristics that are completely uncontrollable and different, just like a fingerprint.鈥�
Advertisement
Many people are concerned that the proliferation of improperly secured internet-connected devices are easy targets for hackers. If we want to live in a world where our fridge can order food for us online, or where our bath starts running when our phone tells it we are 10 minutes from home, then PUFs could be a way to protect ourselves.
There are lots of systems out there for storing encryption keys securely, says Steve Owen at NXP Semiconductors, which is using PUFs supplied by Intrinsic-ID to make secure chips in credit cards. NXP鈥檚 chips have 112 different security features, he says.
The best security systems at present 鈥� such as Apple鈥檚 鈥渟ecure enclave鈥�, which recently prevented the FBI from accessing an iPhone 鈥� are expensive and complicated works of engineering. With billions of devices being connected to the internet 鈥� many of which are throwaway 鈥� a low-cost alternative is needed. 鈥淵ou can鈥檛 afford to put a big computational engine into everything,鈥� says Owen.
PUFs could provide an answer. The alignment of silicon crystals in a chip is fixed when it is produced. Upon applying a current, bits flip to a 1 or 0 state on the basis of this arrangement 鈥� producing a pattern that amounts to a signature for the chip.
But just as a human fingerprint is only a useful method for identifying someone once you know how to read it, the trick with PUFs has been to harness these production patterns for the purposes of encryption. A signature can be read simply by passing electricity through the chip 鈥� and then used to sign a message destined for just one place. But only recently has this technique become accurate and efficient enough to be built into cheap off-the-shelf devices.
What鈥檚 more, because a chip鈥檚 fingerprint is only produced when current is flowing, the system is even more secure than most existing approaches 鈥� at least in theory. Securing a device such as a smartphone is usually done using a system based on digital keys stored on a hard drive. But there is a small 鈥� yet real 鈥� risk of the key being copied, even when the device is turned off. With PUFs, the fingerprint disappears without the current. 鈥淲hen you turn off the power, there is nothing left,鈥� says Kennes.
鈥淟ike humans, every silicon chip has a fingerprint that can be used to uniquely identify it鈥�
However, before becoming widespread, PUFs must be vetted by the security community. In a 2012 paper, researchers from Technische Universit盲t Darmstadt in Germany evaluated different kinds of PUF. They found that three types have features that could make them vulnerable to attacks that involve raising a chip鈥檚 temperature 鈥� but not the kind being rolled out in credit cards.
Owen says he sees the tech not as a replacement for existing systems, but as an additional layer that may allow us to secure more devices more cheaply.
This article appeared in print under the headline 鈥淐hip design quirks make our lives more secure鈥�
