NAND flash can verify a device's identity

Tests of a flash chip's unique characteristics could prevent counterfeiting, researchers say

People who make, buy and sell flash storage could detect counterfeit products based on the unique "fingerprints" of the chips, using techniques being developed by university researchers.

Scholars at the University of California at San Diego and Cornell University have developed software to test variations in flash behavior that are unique to each chip, said Steven Swanson, an associate professor at UCSD and director of UCSD's Non-Volatile Systems Laboratory. By running the same test in the factory and then further up the supply chain, for example, a company could compare the results to verify that a flash chip was authentic, he said.

One industry observer believes this could be a useful tool.

"There's a lot of counterfeit in the [supply] chain," said analyst Roger Kay of Endpoint Technology Associates. It can be hard to detect, because the chain is not always as simple as a device maker contracting with one flash manufacturer to supply the chips for an entire production run of consumer devices, he said. System vendors need to fill unexpected surges in demand, so they often buy small lots of chips on the open market.

There are many third parties that buy and sell these chips, Kay said. "This is one of the biggest things they do, is verify parts, and it's a pain," Kay said.

UCSD's Swanson discussed his team's work at the Flash Memory Summit in Santa Clara, California, this week.

Swanson proposed another possible use of the technology: to prevent counterfeiting of devices such as cellphones and tablets that contain flash. It could also be used by governments to determine whether spies had swapped an official's phone with a seemingly identical one that is bugged, he said.

Testing flash silicon as a proxy for an entire device provides an authentication technique that doesn't require any hardware changes, Swanson said. It only requires firmware and an infrastructure for testing devices at key points in the supply chain, he said.

"I think if someone wanted to do this, they could do it now," Swanson said. The technology could be licensed to manufacturers, who would create a database of results for each of the chips that ships out of the factory. No manufacturers have approached Swanson's team yet, he said. The research was first presented last month.

The system uses "physically unclonable functions" (PUFs), or variations in manufacturing that are unique to each element of each flash chip. Swanson described one PUF that his team has worked with, called Program Disturb. It uses a type of manufacturing flaw that doesn't affect normal operation but causes problems under test conditions.

Data is written and erased from NAND flash through changes in the states of each cell, which are applied by sending a voltage through the cell. If a cell is rewritten many times in a row, the voltage can bleed into an adjacent cell so much that the adjacent cell also changes its state. The order in which cells are modified prevents this from happening in normal operation, Swanson said.

In the test, the number of repetitions it takes to disturb the neighboring cell depends on the thickness of the barriers between the cells and other factors, which vary from one chip to another, Swanson said. The Program Disturb test counts the number of repetitions needed to cause the cell next door to change its state, typically hundreds or thousands. It can be run again later to see if that number matches the original result.

The UCSD researchers even considered the possibility that a highly skilled and motivated hacker, such as an enemy government, could fool this test. The hacker might test the NAND flash itself and store the expected values on the chip, then replay the expected results when the chip was tested. In this way, they could impersonate the authentic chip. However, tests showed that there would not be enough room on any chip to store the data needed to carry this out. The amount of data needed would grow with the capacity of the chip and would be orders of magnitude larger than its capacity, he said.

Analyst Kay believes one advantage of this technique is that it uses immutable characteristics of the chip, so it could be carried out and repeated at any stage when a supplier or manufacturer wanted to verify the hardware. But he thinks demand for the system would most likely come from within the flash industry rather than from consumers.

Stephen Lawson covers mobile, storage and networking technologies for The IDG News Service. Follow Stephen on Twitter at @sdlawsonmedia. Stephen's e-mail address is stephen_lawson@idg.com

Join the PC World newsletter!

Error: Please check your email address.

Tags SSDDrivesstoragesecurityUniversity of CaliforniaSan DiegoCornell University

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Stephen Lawson

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?