ABC: Enabling Smartphone Authentication with Built-in Camera

Size: px

Start display at page:

Download "ABC: Enabling Smartphone Authentication with Built-in Camera"

Samuel Hart
5 years ago
Views:

1 ABC: Enabling Smartphone Authentication with Built-in Camera Zhongjie Ba, Sixu Piao, Xinwen Fu f, Dimitrios Koutsonikolas, Aziz Mohaisen f and Kui Ren f 1

Camera Identification: Hardware Distortion

Fingerprint! [1] LUKAS, J., FRIDRICH, J.

Digital camera identifi- cation from sensor

2 Camera Identification: Hardware Distortion Manufacturing imperfection leads to pattern noise: Photo Response Non-Uniformity (PRNU)[1] Non-Uniform Pixel Unique Fingerprint! [1] LUKAS, J., FRIDRICH, J., AND GOLJAN, M. Digital camera identifi- cation from sensor pattern noise. IEEE Transactions on Information Forensics and Security 1, 2 (2006),

Camera Identification: Fingerprint Matching Given an

interest Filter Threshold Query image Noise Residue

identification accuracy is mainly determined by the

Training images Reference Fingerprint Image source:

3 Camera Identification: Fingerprint Matching Given an image, determine if it is captured by a camera of interest Filter Threshold Query image Noise Residue Similarity (PCE) Compare Extract The final identification accuracy is mainly determined by the quality of each fingerprint (target & reference). Training images Reference Fingerprint Image source: 3

4 From Camera Identification to Smartphone Identification Smartphone cameras have displaced the conventional digital camera Smartphones are widely used in security sensitive tasks 4 Image source:

5 Smartphone Camera VS Digital Camera 5

6 Smartphone Camera: Stronger Non-Uniformity The reduction in dimension amplifies the pixels non-uniformity Same level of manufacturing imperfection Stronger non-uniformity 6

7 Smartphone Camera: Higher Identification Accuracy One image alone can uniquely identify a smartphone camera 30 iphone 6 and 10 Galaxy Note 5 16,000 images collected from Amazon Mechanical Turk 7

Smartphone Authentication Scenario The user

the fingerprint of its built-in camera 1.

8 Smartphone Authentication Scenario The user proves her identity to the verifier using her smartphone as a security token The verifier authenticates the user s smartphone by checking the fingerprint of its built-in camera 1. VLC Channel 2. Wireless Channel User with a smartphone Verifier 8

9 A Strawman Solution I m Bob, give me $100 Send me an image Who Yes, taken you are by are Bob s you? camera Bob Verifier Matching Image source: 9

Security Risk 1: Fingerprint Leakage Images

available to the public Facebook Instagram Wechat

10 Security Risk 1: Fingerprint Leakage Images captured by smartphone cameras, in most cases, are available to the public Facebook Instagram Wechat 10 Image source:

11 Fingerprint Leakage: The Replay Attack Send me an image Who arebyare taken Bob s Yes, you Bob you? camera I m Bob, give me $100 Download Bob s Facebook Adversary Verifier Matching 11

Solution: Randomized QR Code Liveness detection: Challenge the user to capture a freshly generated QR code Accurate Efficient Easy to randomize Easy

12 Solution: Randomized QR Code Liveness detection: Challenge the user to capture a freshly generated QR code Accurate Efficient Easy to randomize Easy to align Image submitted to the authentication system should match the challenge Image source: 12

source: http://www.jiguo.com/article/article/51934.html; http://www.

13 Security Risk 2: Fingerprint Forgery An adversary can manipulate an image s fingerprint and fabricate forged images Fingerprint Injection Image source: Fingerprint Removal 13

14 Fingerprint Forgery: The Injection Attack Capture this image Who are are using camera Yes, Bob s you Bob you? and send it to me. I m Bob, give me $100 Capture Download Extract Bob s Facebook Injection Adversary Verifier Matching 14

Injection Detection Detect forged images that carry injected fingerprints Image source: http://www.entornointeligente.

15 Injection Detection Detect forged images that carry injected fingerprints Image source: 15

16 Normal Image VS Forged Image The generation of normal images Environmental noise (Random noise) Captured image Legitimate smartphone Target image 16

noise Fingerprint injection Photographing Forged

17 Normal Image VS Forged Image The generation of forged images Legitimate fingerprint Environmental noise Fingerprint injection Photographing Forged image Captured image Adversary s smartphone Target image 17

18 Normal Image VS Forged Image Forged images carry the foreign fingerprint of the adversary s smartphone camera 18

19 Solution: Correlation Test Revised challenge response process: Challenge the user to capture and upload two freshly generated QR codes. I m Bob, give me $100 Capture these images using Bob s camera and send them to me. Bob Verifier 19

20 Solution: Correlation Test Reference Fingerprint Extract Correlation 2 (PCE2) Extract Captured image 1 Noise residue 1 Noise residue 2 Captured image 2 20

21 Injection Detection: Normal Image Pair PCE1 PCE2 Correlation 2 (PCE2) 21

22 Injection Detection: Forged Image Pair PCE1 << PCE2 Correlation 2 (PCE2) 22

and 450 normal image pairs Galaxy Note 5: 1600 forged

23 Effectiveness of Injection Detection 16,000 images from Amazon Mechanical Turk iphone 6: 400 forged image pairs and 450 normal image pairs Galaxy Note 5: 1600 forged image pairs and 1400 normal image pairs iphone 6 Galaxy Note 5 23

24 Authentication Work Flow What if the adversary removes his camera fingerprint? 24

25 Removal Detection Detect forged images that have been sanitized (fingerprint removal) Image source 25

26 Normal Image VS Forged Image All white Gaussian noise components will be removed in the process of fingerprint removal 26

27 Solution: Probe Signal Embed a probe signal that will be removed by the fingerprint removal process Environmental noise (Random noise) Probe signal (a white Gaussian noise) Embedding Captured image Legitimate smartphone Target image 27

28 Solution: Probe Signal Detect removal attacks by checking the existence of the probe signal 28

29 Solution: Probe Signal Detect removal attacks through checking the existence of the probe signal Filter Threshold Captured Image Noise Residue Similarity (PCE) Compare Filter Challenged scene Probe Signal 29

30 Effectiveness of Removal Detection Setting 1: Target scene have no probe signal. Setting 2: Target scene have a probe signal. Normal Image. Setting 3: Target scene have a probe signal. Removal Attack. 1. The probe signal is preserved in legitimate image tokens. (Setting 1 VS Setting 2) 2. The probe signal is suppressed in forged images. (Setting 2 VS Setting 3) Forged images can be easily detected 30

Full-fledged Authentication Protocol I m Bob,

Bob Verifier Image Content Matching Embed

31 Full-fledged Authentication Protocol I m Bob, give me $100 Capture these images Who are using Bob s Yes, you are Bob camera you? and send them to me. Bob Verifier Image Content Matching Embed probe signal Fingerprint Verify Matching Injection Detection Removal Detection 31

32 The Attack Detection Flow Fingerprint leakage resilience Reliable camera identification Removal attack Fingerprint forgery Resilience Injection attack 32

33 Efficiency Image Content Matching: Determined by the version of the applied QR code. Normally can be finished within 0.1 second. Fingerprint Matching: Determined by the resolution of the captured image. This is the most time consuming part. Injection Detection: Determined by the resolution of the captured image. Normally can be finished within 0.5 second. Removal Detection: Determined by the resolution of the probe signal. It takes at most 0.9 second. 33

34 Efficiency Fingerprint Matching Overall Efficiency 34

35 What Factors can Influence PRNU? Does PRNU change over time? No Will the ambient environment affect the fingerprint on an image? Only ambient light intensity. What is the relationship between an image s resolution and the strength of its fingerprint? Positively correlated 35

36 Conclusion The first work to enable smartphone authentication using built-in camera Accurate and efficient identification Resilient to fingerprint leakage and forgery Thank you! Questions? 36

37 Reinforced Fingerprint Forgery: the Removal Attack Extract Capture Extract Download Bob s Facebook Removal Adversary Verifier Injection Injection 37

Retrieval of Large Scale Images and Camera Identification via Random Projections

Retrieval of Large Scale Images and Camera Identification via Random Projections Renuka S. Deshpande ME Student, Department of Computer Science Engineering, G H Raisoni Institute of Engineering and Management