By Boris Škorić, Eindhoven University of Technology

Decades of data security research have brought us highly reliable, standardized tools for common tasks such as digital signatures and encryption. But hackers are constantly working to crack data security innovations. Current credit/debit card technologies put personal money at risk because they’re vulnerable to fraud.

Physical security – which deals with anti-counterfeiting and the authentication of actual objects – is part of the problem too. The good guys and bad guys are locked in a never-ending arms race: one side develops objects and structures that are difficult to copy; the other side tries to copy them, and often succeeds.

But we think our new invention has the potential to leave the hackers behind. This innovative security measure uses the quantum properties of light to achieve fraud-proof authentication of objects.

PUFs: fighting with open visors

The arms race is fought in secret; revealing your technology helps the enemy. Consequently, nobody knows how secure a technology really is.

Remarkably, a recent development called Physical Unclonable Functions (PUFs) has made it possible to be completely open. A PUF is a piece of material that can be probed in many ways and that produces a complex response that depends very precisely on the challenge and the PUF’s internal structure.

The best known examples are Optical PUFs. The PUF is a piece of material – such as white paint with millions of nanoparticles – that will strongly scatter any light beamed at it. The light bounces around inside the paint, creating a unique pattern that can be used for authentication. Optical PUFs could be used on any object, but would be especially useful on credit/debit cards.

Imagine presenting your card to an ATM. The ATM fires a laser beam at the white paint on the card. The beam has an intricate, unpredictable “shape” (angle, focus, pixel pattern) randomly generated by the ATM, which serves as the challenge. Inside the PUF, the light scatters many times, causing lots of interference.
The exiting light is the response – a complex pattern of dark and bright spots known as speckle that the ATM can record with a camera. The ATM has access to the PUF enrollment database and thus knows the properties of your card’s PUF when you insert it. The ATM computes what the reflected speckle pattern should look like. If the resemblance is close enough, the ATM considers the card authentic.

Speckle is sensitive to tiny changes in the challenge and the PUF’s structure. Due to the complexity of speckle physics, PUFs are practically unclonable.

The process for manufacturing PUFs does not have to be kept secret, precisely because of the unclonability: even if you know the manufacturing process, the uncontrollable randomness in the process still prevents you from cloning PUFs. One could organize open competitions and establish solid standards for physical security akin to those in cryptography.

Digital emulation still a problem

It’s conceivable a PUF could be cloned exactly, or physically emulated precisely, although it would be very, very difficult. With Optical PUFs the good guys are firmly on the winning side in the arms race.

A bigger risk for the authentication protocol is digital emulation. A digital emulation attack on a particular PUF would consist of three steps:

• First, a hacker measures the challenge. In the ATM example, this is the laser beam.
• Second, the hacker obtains the response to this challenge. This can be done either by looking it up in a previously compiled table, or by running emulation software. (Remember, the attacker knows everything about each PUF because this is public knowledge.)
• Third, the hacker sends out laser light with what he’s determined the correct “response” speckle pattern to be.

We are interested in “remote” authentication, where the verifier has no direct control over the PUF, and the attacker knows everything about the PUF. This scenario typically requires the verifier to put in the field heavily defended hardware devices (like ATMs), whose task is to read PUFs without being spoofed. But this opens a second type of arms race, namely designing secure electronics versus hardware hacking and spoofing. In this kind of game the “good guys” often find themselves on the losing side.

Solution: Quantum Readout

A few years ago, I realized that using quantum physics in the PUF readout would completely eliminate the threat of digital emulation.

The challenge has to be an unpredictable quantum state – that is, a single photon – which then interacts with the PUF and returns as a modified quantum state. Instead of a “classical” speckle pattern as above, the verifier is looking for a lone photon in a particular complicated quantum state.

Due to the laws of quantum physics, an attacker cannot accurately determine what the challenge is. If the hacker tries to watch the photon, he collapses the quantum state – any attempt at measurement destroys most of the information. And the No Cloning Theorem says that it’s impossible to create an identical copy of a quantum state.

The attacker is out of luck. Not knowing the challenge, he doesn’t know where to look in his lookup table for a response. The verifier, on the other side, knows exactly which response is expected (in contrast to the attacker, he does know the challenge) and is able to determine if the returning photon is in the right state.

Though the security of the Quantum Readout concept has been rigorously proven, it was not immediately clear how to realize Quantum Readout in practice.

Manipulation of light

The funny thing about a photon is that it is both particle and wave. Since it is a particle you have to detect it as a single chunk of energy. And being a wave, it spreads out and interferes with itself, forming a speckle pattern response. Quantum light is like a complicated-looking ghost. But how do you verify a single-photon speckle pattern?

In 2012, researchers at Twente University realized they held the answer in their hands. The magic ingredient is a Spatial Light Modulator (SLM), a programmable device that re-shapes the speckle pattern. In their experiments, they programmed an SLM such that the correct response from an Optical PUF gets concentrated and passes through a pinhole, where a photon detector notices the presence of the photon. An incorrect response, however, is transformed to a random speckle pattern that does not pass through the pinhole.

The method was dubbed Quantum-Secure Authentication (QSA).

Quantum, but not difficult

QSA does not require any secrets, so no money has to be spent on protecting them. QSA can be implemented with relatively simple technology that is already available. The PUF can be as simple as a layer of paint.
It turns out that the challenge does not have to be a single photon; a weak laser pulse suffices, as long as the number of photons in the pulse is small enough. Laser diodes, as found in CD players, are widely available and cheap. SLMs are already present in modern projectors. A sensitive photodiode or image sensor can serve as the photon detector.

With all these advantages, QSA has the potential to massively improve the security of cards and other physical credentials.

This article was originally published on The Conversation.
Read the original article.

By Thomas Snitch, University of Maryland

In 2014, 1,215 rhinos were killed in South Africa for their horns, which end up in Asia as supposed cures for a variety of ailments. An estimated 30,000 African elephants were slaughtered last year for their tusks to be turned into trinkets. The world loses three rhinos a day and an elephant every 15 minutes. Simply stated, this is an unsustainable situation.

Our team at the University of Maryland’s Institute for Advanced Computer Studies has created a new multifaceted approach to combat poaching in Africa and Asia. We devise analytical models of how animals, poachers and rangers simultaneously move through space and time by combining high resolution satellite imagery with loads of big data – everything from moon phases, to weather, to previous poaching locations, to info from rhinos’ satellite ankle trackers – and then applying our own algorithms. We can predict where the key players are likely to be, so we can get smart about where to deploy rangers to best protect animals and thwart poachers.

The real game changer is our use of unmanned aerial vehicles (UAVs) or drones, which we have been flying in Africa since May 2013. We’ve found that drones, combined with other more established technology tools, can greatly reduce poaching – but only in those areas where rangers on the ground are at the ready to use our data.

Scope of the problem

In the past 10 years, the poaching of elephants and rhinos has increased exponentially, primarily because it’s a very lucrative criminal business. Rhino horns can fetch more than US$500,000 or over $50,000 per kilogram – this is more than the cost of any illegal narcotic – and a pair of elephant tusks can reach US$125,000. Most of these illegal activities are run by Asian criminal syndicates and there are well-founded beliefs that some of these proceeds are being funneled to political extremists in Africa.

Being smart about deploying technology

Technology is a marvelous tool but it must be the right solution for a particular problem. Engineering solutions that might work with the US military looking for people planting IEDs in Afghanistan will not necessarily work in the African bush, at night, searching for poachers. The most challenging question about how UAVs are used in Africa is when and where to fly them.

Africa is too big to be simply launching small drones into the night sky with the hope of spotting rhinos or poachers by chance. This is where the analytical models come into play. Based on our models, we know, with near 90% certainty, where rhinos are likely to be on a particular night between 6:30 and 8:00, prime time for killings. At the same time, by mathematically recreating the environment when previous poachings have occurred, we have a very good idea of when and where poachers are likely to strike.

We don’t have to find poachers, we just need to know where the rhinos are likely to be.

For example, a large proportion of poachings occur on the days around a full moon; it makes sense since that’s when poachers can easily see their prey. In one area where we have months of experience, we discovered that nearly every poaching occurred with 160 meters of a road. It’s simple. The poachers are driving the perimeter of the park in the late afternoon spotting animals near the park fence; they return just after sundown, kill the animal and drive away. We pile on the data, and the algorithms do the rest.

Data informs on-the-ground rangers

The key is that the satellites, the analytics and math, and the UAVs are integrated into a solutions package. We crunch the data, and the model tells us precisely where we should deploy our rangers, on any specific night, so they will be in front of the rhinos and can intercept the poachers before they reach the target animal. After all, there’s no value in rangers patrolling parts of the park that these animals are unlikely to ever visit. Consider that South Africa’s Kruger National Park is the size of the state of New Jersey. Like a bank robber who robs banks because that’s where the money is, we want our rangers to be near the rhinos because that’s where the poaching is.

On our first UAV flight in South Africa, the UAV flew to our pre-determined spot and immediately found a female rhino and her calf; they were within 30 meters of a major road. We decided to circle the drone over the rhinos and within minutes a vehicle stopped at the park’s fence. Three individuals exited the car and began to climb the fence to kill the rhinos. Our rangers had been pre-deployed to the area; they arrested the three poachers in under 3 minutes. This episode has been repeated dozens of times over the past 20 months.

The most critical issue is not how far or how long a UAV can fly but how fast can a ranger be moved, in the bush at night, to successfully intercept poachers. The UAVs are simply our eyes in the night sky. Watching their live infrared video streams, we move our rangers as if they were chess pieces. Even with great math, we have some variance and that means we might be 200 meters off a perfect positioning. The UAVs can see poachers at least 2 kilometers from the rhinos. So we have 45 minutes to move our people into the most optimal position – based on our real world trials on how quickly they can move through the bush at night.

We’ve had hundreds of night flights with over 3,000 flight hours in the past 20 months and here is what we’ve learned. First, on the first few days after we begin operating in a new area, we arrest a number of poachers and they’re being prosecuted to the fullest extent of local laws.

Second, our models are heuristic in that they are constantly learning and self-correcting, on the lookout for changes in the patterns they’ve identified. This is critical since poachers will try to change their behavior once they learn that they are at an extremely high risk of apprehension. The sheer number of animals being killed shows us that, up until the UAVs take to the air, most poachers have been able to operate with impunity.

The most important finding is that in every area where we have put our solutions package to work and the UAVs are flying, poaching stops with 5 to 7 days. Period – it stops. Tonight we are flying in a very challenging area in southern Africa – we don’t identify our flight operations so as not to alert the poachers – and over the past 90 days, there has not been one single poaching incident. Four months ago, this region was losing several rhinos a week.

The good news is that we have proof of concept and proof on the ground that UAVS can make a tremendous difference. The bad news is that the poachers are moving to regions where we are not operating. To really address the challenges of poaching in the region, all the nations in southern Africa should be willing at least to test our system in their most critically endangered areas.

Our solution to the poaching problem lies in the combination of satellite monitoring, great math, properly positioned rangers and UAVS flying precise flight paths. It works.

This article was originally published on The Conversation.
Read the original article.