Unique cpu signals enable new device fingerprint authentication method
CPU-Auth: Device Fingerprinting for Authentication via DVFS Side-Channel
Cryptography and SecurityMachine Learning
Summary
Authentication often relies on things like text message codes, biometrics, or tokens, each with their own weaknesses. The authors explore a new way to identify and authenticate devices based on tiny differences in how each CPU manages its power and speed settings. By measuring these differences remotely through a web browser, they create a unique fingerprint for each device. They tested this idea extensively using many samples and machine learning to check its accuracy.
What this means in practice
- •For web developers: Integrate CPU-Auth to verify user devices using unique CPU behavior measured directly in browsers, adding hardware-based security without extra hardware.
- •For enterprise security teams: Use CPU-Auth fingerprints as an additional factor to detect device identity and strengthen authentication against unauthorized access.
Authors
Ryan Swift
Abstract
Lack of effective authentication has resulted in numerous security and privacy breaches, including unauthorized access to protected information, identity theft, and fraud. One approach to mitigating such attacks is Multi-Factor Authentication (MFA), in which users must provide multiple pieces of information for authentication. Some secondary authentication factors include SMS text verification codes, biometrics, and tokens. Each contains at least one notable flaw: SMS is notoriously insecure; biometrics rely upon access to sensitive personal data; and tokens require dependence on third-party providers (e.g. OAuth providers). This work explores CPU-Auth, a novel authentication mechanism based on unique variations in the physical characteristics of the CPU of a computing device. By measuring the behavior of the Dynamic Voltage and Frequency Scaling (DVFS) governor remotely from within a browser, unique properties of the CPU can be leveraged to establish a hardware-based device fingerprint for use in CPU-Auth. The performance of CPU-Auth is evaluated on over 50,000 data traces using distance-based and deep learning methods. CPU-Auth is part of a larger research project, and the results provided in this report reflect only the contributions made to the project by members of this group.