Optical identifier comprising an identification layer and a sensor layer
The invention relates to an optical identifier comprising an identification layer, in particular a physical unclonable function, and a sensor layer arranged on one side of said identification layer comprising a plurality of sensor areas for detecting an identification signal generated by said identification layer in response to an irradiation beam. The invention further relates to a device comprising such an optical identifier and to a reading device for identifying such an optical identifier.
The use of "physically unclonable functions" (PUFs) for security purposes is known, e.g. from US 6,584,214. Incorporating a PUF into a device such as a smart card, chip, or storage medium makes it extremely difficult to produce a "clone" of the device. "Clone" means either a physical copy of the device or a model that is capable of predicting the input- output behavior of the device with reliability. The difficulty of physical copying arises because the PUF manufacturing is an uncontrolled process and the PUF is a highly complex object. Accurate modeling is extremely difficult because of the PUF's complexity; slightly varying the input results in widely diverging outputs. The uniqueness and complexity of PUFs makes them well suited for identification, authentication or key generating purposes. Optical PUFs can consist of a piece of, e.g., epoxy containing glass spheres, air bubbles or any kind of scattering particles. The epoxy can also be replaced by some other transparent means. Shining a laser through a PUF produces a speckle pattern which strongly depends on the properties of the incoming wave front and on the internal structure of the PUF. The input (wave front) can be varied by shifting or tilting the laser beam or by changing the focus. Even a slightly changed input may greatly affect the output (speckle pattern).
An optical Physical Unclonable Function (PUF) may consist of a cured resin, e.g. epoxy, containing glass spheres, air bubbles or any other scattering particles, which are randomly distributed. A PUF can be used as a secure identification of, for instance, smart cards, sim cards etc. More in general, a PUF is a secure, uncloneable source of key material for cryptographic purposes.
A laser beam impinging upon a PUF produces a speckle pattern at a certain distance from the PUF. The size of the speckles in the pattern is proportional to the wavelength and distance from the PUF and inversely proportional to the diameter of the laser beam. The speckle pattern may be measured with a CMOS (complementary metal oxide semiconductor) or CCD (charge-coupled device) sensor. In general, in a CMOS sensor the wiring to the individual pixels lies above the pixels, while in a CCD sensor the wiring lies - in the same layer as the pixels - between the pixels.
When a smart card or the like comprising a PUF is put into a "reader" challenges may be applied to it in order to verify its identity. These challenges result in different speckle patterns which are to be detected by a suitable detector or sensor. Further details of an identification system based on optical PUFs can be found in the article "Physical One- Way Functions" Ravikanth Pappu et al., Vol. 297 SCIENCE, 20/09/2002, and in EP Patent Applications 03101346.9 and 04100710.5
In order to improve the reliability of the detecting and the security of the identifier it is preferred to rigidly attach the identifying part of the identifier, e.g. the PUF, to the sensor. An identifier which comprises a radiation source and a sensor enclosed by a PUF made of epoxy is known from US 2003/0204743 Al. Thus, according to US 2003/0204743 Al, the identifier comprises all components, such as radiation source, identification layer and sensor. However, with the sensor being directly adjacent to the PUF the speckle-size in the speckle pattern will be very small. The smallest details in the pattern will now be about half the wavelength of the laser light used.
On the other hand, the smallest size of the photosensitive pixels on the sensor is nowadays about 4 μm. The picture taken by such a sensor will smear out the high- frequency modulations, i.e. the smallest details, in the speckle pattern and hence only the low-frequency components will be measured. This is a serious problem, as most of the information in the speckle pattern is contained in the high-frequency part.
It is an object of the present invention to provide an optical identifier of the type described in the opening paragraph which allows for an effective detection of the identification signal.
This object is achieved by an optical identifier as claimed in claim 1. The identification signal is integrated over an area which is relatively small if compared to the spatial frequency of the identification signal, i.e. an area sufficiently small not to average
the identification signal over a too large size to retain any useful information. This can be further explained as follows. The area over which the identification signal is integrated is related to a frequency, herein referred to as integration frequency, which is equal to the inverse of the area. Given an identification signal having a certain spectrum, ideally the integration frequency is higher than the highest component in frequency of the spectrum; however it is also possible to have an integration frequency corresponding to a component in frequency in the middle of the spectrum; less advantageous but nevertheless acceptable if it is in the lower part of the spectrum; what needs to be avoided is that the integration frequency is lower that the lowest component of the spectrum, because in this case no useful information of the identification signal would be retained at all.
In an embodiment of the optical identifier according to the invention, a mask is provided between said sensor layer and said identification layer comprising a plurality of holes allowing the identification signal to pass through the mask and hit the sensor areas on the opposite side of the mask, wherein only a predetermined part of each of said sensor areas is exhibited to said identification signal.
In order to obtain a useful picture with a sufficient reliability of the identification process the pixel size or sensor area of the sensor layer should be in the range of the high-frequency modulation of the identification signal. Since it is difficult to produce pixels which are small enough for this purpose it is preferred to mask out a part of the identification signal. One sensor area measures the average value of the intensity of the identification signal to which it is exhibited. Thus, a quite large sensor area will only be able to detect a signal which is averaged over its large size. The smaller details of the identification signal cannot be detected and will be lost. When the area which is hit by the identification signal is reduced by including a pinhole mask between the identification layer and the detector, preferably at predetermined locations, this makes it possible to detect the smaller details which now have a much larger impact on the averaged value of the intensity detected by the reduced area.
The wiring and the dead area between the pixels also take some space, so the distance between the exhibited sensor area portions will be much larger than half a wavelength. Hence, the speckle pattern will now be sampled, for instance every 10th speckle. As a side effect, the sensitivity to a deviation of the entrance angle or the position of the probe beam will be increased, too, which also may increase the merits of the optical identifier.
While using a standard CMOS/CCD detector with a pixel size of, for example, 4 μm, the pinholes of the mask ensure that the effective pixel size is substantially equal to the size of the pinholes, so that small details of a speckle pattern can be detected.
In an embodiment of the optical identifier according to the present invention said mask is formed by a masking portion of said sensor layer. When said mask is included into said sensor layer there is no need for an additional step of producing a mask separately from the identification layer and the sensor layer. Further, it is possible to produce one type of sensor layer including said mask which can be used for different types of identification layers. In another embodiment of the optical identifier said masking portion is formed by a wiring connected to said sensor areas and provided for outputting sensor signals from said sensor layer. Since there has to be a wiring for reading out the signals detected by said sensor areas anyhow, this wiring is used as said mask. Thus, the provision of said mask is done by producing said wiring. This allows to make the whole identifier thinner. In a further embodiment of the optical identifier said holes of said mask have a size smaller than 4 μm2, preferably smaller than 1 μm2, in particular smaller than 0.25 μm2. A smaller size of the holes results in an improved sensitivity in terms of the small details of the speckle pattern comparable in size to the wavelength of the used radiation. However, the sensitivity in terms of the detectable intensity decreases as only a part of the identification signals reaches the sensor areas.
In still a further embodiment of the optical identifier said sensor areas have a size smaller than 4 μm2, preferably smaller than 1 μm2, in particular smaller than 0.25 μm2. This also results in an improved sensitivity in terms of the small details of the speckle pattern comparable in size to the wavelength of the used radiation. In this embodiment the wiring can be positioned between the identification layer and the sensor areas or, alternatively, between the sensor areas, thus avoiding some processing steps in the manufacture of the optical identifier. Furthermore, in this embodiment a CMOS sensor layer is preferably used, and the mask could even be left out, i.e. the identifier thus only comprising the identification layer, a wiring and a sensor layer having very small sensor areas. In either case what is achieved is that the identification signal is integrated over area which is relatively small compared to the spatial frequency of the identification signal.
It is further proposed to provide a device comprising an optical identifier according to the present invention wherein said optical identifier substantially uniquely identifies said device.
In a preferred embodiment of the device comprising an optical identifier, said device is a smart card, a SIM card, a credit card, an ID card, an ID tag or a data carrier.
A reading device for identifying an optical identifier according to the present invention is also proposed, said reading device being adapted for applying an irradiation beam to said identification layer, said reading device being further adapted for reading out sensor signals from said sensor layer being indicative for said identification signal.
In the following, the invention will be explained further in detail with reference to the figures, in which:
Fig. 1 shows an optical identifier according to the present invention applied in a user device and read out by a reading device,
Fig. 2 shows a speckle pattern in which the parts of the speckle pattern detected by a known optical identifier are indicated, and Fig. 3 shows the speckle pattern of Fig. 2 in which the parts of the speckle pattern detected by an optical identifier according to the present invention are indicated.
Fig. 1 shows an optical identifier 1 according to the present invention included into a user device 2. Further, a reading device 20 according to the present invention is shown. The optical identifier 1 comprises an identification layer 3, a sensor layer 4 and a mask 5 provided between said identification layer 3 and said sensor layer 4. Said mask 5 comprises a plurality of holes 6 each positioned at one of the plurality of sensor areas 7 of said sensor layer 4. The optical identifier further comprises a wiring 8 which is connected to said sensor areas 7 and to an interface 9. The identification layer 3 represents a physically unclonable function (PUF) consisting for example of cured resin with scattering particles 10, dispersed within.
The reading device 20 for identifying the identifier 1 comprises an irradiation source 11 for applying an irradiation beam 12 to said identification layer 3 and a reading unit 13 which is connectable to a said interface 9 in order to read out sensor signals from said sensor areas 7.
An irradiation beam 12 is generated by said irradiation source 11 and applied to said identification layer 3. In response to said irradiation beam 12 the scattering particles 10 of the identification layer 3 cause the generation of an identification signal 21 which is
shown in Figs. 2 and 3. A predetermined part of the identification signal 21 hits said sensor areas 7 after passing though said mask 5 by said holes 6. The sensor signals generated by said sensor areas 7 are transmitted by said wiring 8 to said interface 9 which outputs said signals to said reading unit 13 of said reading device 20 in order to allow said reading device to identify said user device 2, in particular by identifying said optical identifier 1 provided therein or thereon.
It shall be noted that the reading device does not necessarily perform the identification. For example, the reading device could process the output of the sensor areas to derive a unique bit string, and then prove to a Verifying Party, for instance over an 'open' connection, that it has knowledge of this bit string.
It shall further be noted that it is preferable to arrange the identification layer 1, the mask 5 and the sensor layer 4 in this order while the wiring 8 can be at any other position suitable to be connected to said sensor areas 7 in order to output the sensor signals. It is further possible to employ the wiring itself as the mask to thereby save the step of providing an additional mask during production of the optical identifier.
Still further, the mask 5 could also be left out if the sensor areas 7 are made very small so that the desired functionality achieved in the embodiment shown in Fig. 1 by the small holes of the mask 7 is now achieved by the small sensor areas instead. However, also in the embodiment shown in Fig. 1 the sensor areas 7 could be made very small. Fig. 2 shows a speckle pattern 21 in which the parts of the speckle pattern 21 detected by a known optical identifier are indicated. An identification signal or speckle pattern 21 is generated in response to an irradiation beam as described above. The size of the details of this identification signal 21 depends on the irradiation beam, in particular on its wavelength, focus and angle of incidence. Known optical sensors as CCD or CMOS sensors now have a pixel size of approximately 4 μm which is indicated by the large squares 22 in Fig. 2. Since the details of the speckle pattern 21 are small in comparison to the pixels 22 these pixels can only detect an average intensity throughout their size. This leads to a substantially uniform value which does not differ much from pixel to pixel.
Fig. 3 shows the speckle pattern 21 of Fig. 2 in which the parts of the speckle pattern 21 detected by an optical identifier according to the present invention are indicated. The parts of the identification signal 21 detected by the sensor areas 7 due to the provision of said mask 5 are indicated by the small squares 31 in Fig. 3. As can be seen, there are a much larger differences between the average signal part detected by said sensor areas 7 which allows a better identification of said optical identifier.
An optical identifier, a device identified by said optical identifier and a reading device for identifying said optical identifier are proposed according to the present invention, wherein a sensor layer is attached directly and rigidly to an identification layer, in particular to a PUF, while ensuring that a sufficient reliability and uniqueness of said optical identifier is achieved for identifying an device comprising said optical identifier being read by said reading device.