SBIR Phase I: Fingerprinting Smart-phones for Strong Authentication

这个小型企业创新研究(SBIR)第一阶段项目探索了利用硬件设备的物理属性(例如相机、闪存、宽带接口等)中的可变性来创建智能手机的安全“指纹”的可行性。由于这些设备的变化是基于制造过程的微妙之处，它们是不可控的。因此，克隆设备并创建具有相同指纹的智能手机的复制品是困难的(如果不是不可能的话)。一旦可靠地提取了智能手机指纹，目标就是将其与从用户那里获得的生物特征信息结合起来。通过将生物识别方案与物理指纹相结合，这项技术可以独特地将人与设备以及他们以加密方式提供的服务联系在一起。这里提出的技术允许人们通过纯软件方法认证任何智能手机的平台和用户的身份，而不需要对底层硬件架构进行任何修改。如果完全集成到智能手机中，拟议的技术有可能将移动设备转变为真正受信任的代理，从而实现新服务的广泛部署。特别是，对智能电话及其用户的强识别成为可能。这对于需要加密强身份验证的应用程序至关重要，例如移动支付系统、移动接入银行自动取款机以及政府机构的移动身份检查。此外，还将启用对高价值应用程序的许可证管理。此外，拟议的技术还将使智能手机和移动平台上的一些按次付费或按使用付费服务成为可能。这些应用突出了该项目的商业潜力。一旦拟议的信任链建立起来，它可能会在智能手机上采用众多服务方面发挥关键作用。

This Small Business Innovation Research (SBIR) Phase I project explores the feasibility of utilizing the variability found in physical properties of hardware devices, e.g., camera, flash memory, broadband interface etc., to create secure "fingerprints" of smart-phones. Since, the variations on these devices are based on the subtleties of the manufacturing process, they are not controllable. Thus it is difficult (if not impossible) to clone the devices and create a replica of the smart-phone that has the same fingerprint. Once the smart-phone fingerprint is reliably extracted, the goal is to combine it with the biometric information obtained from a user. By integrating biometric schemes with physical fingerprints this technology can uniquely tie persons to devices along with the services they carry in a cryptographically strong manner. The technology proposed here allows one to authenticate the identity of both the platform and the user of any smart-phone through a software only approach and without any modification to the underlying hardware architecture. If fully integrated into smart-phones, the proposed technology has the potential to transform mobile devices into truly trusted proxies thus enabling wide scale deployment of new services. In particular, strong identification of the smart-phone and its user becomes possible. This is crucial for applications that require cryptographically strong authentication, e.g., mobile payment systems, mobile access to bank ATM's, and mobile identity checks for governmental agencies. Moreover, license management for high value applications would be enabled. Even further, the proposed technology would also enable a number of pay-per-view or pay-per use services on smart-phones and mobile platforms. These applications highlight the commercial potential of this project. Once the proposed chain of trust is built, it could play a pivotal role in the adoption of numerous services on smart-phones.