SensorID: Sensor Calibration Fingerprinting for Smartphones

Abstract

Sensors are an essential component of many computer systems today. Mobile devices are a good example, containing a vast array of sensors from accelerometers and GPS units, to cameras and microphones. Data from these sensors are accessible to application programmers who can use this data to build context-aware applications. Good sensor accuracy is often crucial, and therefore manufacturers often use perdevice factory calibration to compensate for systematic errors introduced during manufacture. In this paper we explore a new type of fingerprinting attack on sensor data: calibration fingerprinting. A calibration fingerprinting attack infers the perdevice factory calibration data from a device by careful analysis of the sensor output alone. Such an attack does not require direct access to any calibration parameters since these are often embedded inside the firmware of the device and are not directly accessible by application developers. We demonstrate the potential of this new class of attack by performing calibration fingerprinting attacks on the inertial measurement unit sensors found in iOS and Android devices. These sensors are good candidates because access to these sensors does not require any special permissions, and the data can be accessed via both a native app installed on a device and also by JavaScript when visiting a website on an iOS and Android device. We find we are able to perform a very effective calibration fingerprinting attack: our approach requires fewer than 100 samples of sensor data and takes less than one second to collect and process into a device fingerprint that does not change over time or after factory reset. We demonstrate that our approach is very likely to produce globally unique fingerprints for iOS devices, with an estimated 67 bits of entropy in the fingerprint for iPhone 6S devices. In addition, we find that the accelerometer of Google Pixel 2 and Pixel 3 devices can also be fingerprinted by our approach.

Factory Calibration Fingerprinting of Sensors

“…We have found that the gain matrix of the gyroscope in iOS devices is factory calibrated and further estimated the nominal gain for different device models based on the gyroscope outputs [2]. In particular, Table I lists the nominal gain (in mdps, millidegrees per second) of the gyroscope for all the iOS devices that we have measured.…”

“…In our previous research we have focused mostly on iOS devices and demonstrated its effectiveness on gyroscope and magnetometer data available in iOS [2]. This paper extends our previous work: we present our latest findings on accelerometer calibration on iOS devices ( §III-E); we conduct a large-scale factory calibration behaviour analysis on popular Android device models ( §III-F); we compare the calibration fingerprint with the Fingerprintjs2 fingerprint for Google Pixel phones ( §IV-B); we analyse the calibration fingerprint for vulnerable Pixel devices and estimate entropy for each model ( §V-B).…”

Probe Request Based Device Identification Attack and Defense

“…Physical features are used in device identification. Under the analysis of the deterministic errors in the calibration process, Zhang et al [ 14 ] infer the per-device factory calibration data from the output of gyroscope, accelerometer and magnetometer. In addition to the motion sensors, the imperfection in embedded Acoustic Components can be used as the device fingerprints [ 15 ].…”

PowerPrint: Identifying Smartphones through Power Consumption of the Battery

“…en, he infers a rough route and compares with the public map to get the user's motion trail. Zhang designed a fingerprinting method based on sensor calibration, which requires only the access to the sensor output [28].…”