Researchers find security breach in 3D printing process

The team, led by Mohammad Al Faruque, director of UCI’s Advanced Integrated Cyber-Physical Systems Lab, showed that a device as ordinary and ubiquitous as a smartphone can be placed next to a machine and capture acoustic signals that carry information about the precise movements of the printer’s nozzle. The recording can then be used to reverse engineer the object being printed and re-create it elsewhere. Detailed processes may be deciphered through this new kind of cyberattack, presenting significant security risks.

“In many manufacturing plants, people who work on a shift basis don’t get monitored for their smartphones, for example,” Al Faruque said. “If process and product information is stolen during the prototyping phases, companies stand to incur large financial losses. There’s no way to protect these systems from such an attack today, but possibly there will be in the future.”

Al Faruque’s team achieved nearly 90% accuracy using the sound copying process to duplicate a key-shaped object in the lab. They will present their results at April’s International Conference on Cyber-Physical Systems in Vienna.

State-of-the-art 3D printing systems convert digital information embedded in source code to build layer upon layer of material until a solid object takes shape. That source file, referred to as G-code, can be protected from cyberthievery with strong encryption, but once the creation process has begun, the printer emits sounds that can give up the secrets buried in the software.

“My group basically stumbled upon this finding last summer as we were doing work to try to understand the relationship between information and energy flows,” said Al Faruque, an electrical engineer and computer scientist. “According to the fundamental laws of physics, energy is not consumed; it’s converted from one form to another – electromagnetic to kinetic, for example. Some forms of energy are translated in meaningful and useful ways; others become emissions, which may unintentionally disclose secret information.”

The emissions produced by 3D printers are acoustic signals that contain a lot of information, he said, adding: “Initially, we weren’t interested in the security angle, but we realised we were onto something and we’re seeing interest from other departments at UCI and from various U.S. government agencies.”

“President Obama has spoken about returning manufacturing to the United States, and I think 3D printing will play a major role because of the creation of highly intellectual objects, in many cases in our homes,” Al Faruque said. But he cautioned that with the convenience of these new technologies come opportunities for industrial espionage.

He suggested that engineers begin to think about ways to jam the acoustic signals emanating from 3D printers, possibly via a white-noise device to introduce intentional acoustic randomness or by deploying algorithmic solutions. At a minimum, Al Faruque said, a fundamental precaution would be to prevent people from carrying smartphones near the rapid prototyping areas when sensitive objects are being printed. Today’s smartphones, he noted, have sensors that can capture a range of analog emissions.