Sunday, September 17, 2023

How Does Qualcomm's Fingerprint Sensor Work?

Introduction

I recently came across a demonstration of the Samsung S22's fingerprint sensor while browsing used phones. Although it was challenging to find accurate information on how this technology works, I did eventually uncover details about its origins. This article outlines what I've learned.

My Motivation


Having previously worked on medical ultrasound imaging, I find the potential of a mass-produced 2D array of ultrasonic transducers particularly intriguing. Such an array could revolutionize low-cost 3D ultrasound imaging.
 

Link to the Initial Research on the Technology


Around 2015, Bernhard E. Boser's research group was instrumental in developing the piezoelectric micromachined transducer (PMUT). Yipeng Lu, one of the authors of the seminal 2016 paper [1] on this topic, joined Qualcomm as a senior engineer. Recent patents by Qualcomm include contributions from Kostadin Dimitrov Djordjev, Jessica Liu Strohmann, and Nicholas Ian Buchan, but this article focuses solely on information from the 2016 paper.

Additional evidence supporting the presence of PMUT devices in Qualcomm's 3D Sonic comes from a report by System Plus Consulting [2]. This report specifically mentions the use of PMUT technology. Furthermore, a YouTube video [3] provides a visual demonstration, showing the kinds of images achievable with a larger version of the sensor:

Construction of the Sensor


The PMUTs are MEMS devices bonded to a CMOS ASIC equipped with high-voltage (24V) transistors.

How Does the piezoelectric micromachined transducer  (PMUT) Work?


The core of a PMUT is an Aluminum Nitride (AlN) layer sandwiched between electrodes. During transmission, an applied voltage causes the AlN membrane to buckle, emitting an ultrasonic wave. When in reception mode, incoming pressure waves induce a charge across the transducer. The front side of the PMUT is coupled to the finger through a 250µm layer of silicone, while the backside is in a vacuum to prevent emission or losses towards the back.

Array Utilization for Imaging


The sensor comprises an array of 110 rows x 56 columns of PMUTs, arranged at a 43µm x 58µm pitch. This array achieves approximately 500 dpi resolution. Column-wise sequential readout is enabled by 56 analog demodulators. Transmit signals, created by exciting five adjacent columns, are time-delayed to focus the ultrasonic beam. The received signals are then processed to construct the image.

The algorithm employed for image construction is quite rudimentary. It essentially captures the envelope of the received ultrasonic signal at a predetermined time instant, without the use of more sophisticated image reconstruction techniques like beamforming or Fourier-based methods.

Conclusion

Pros

Qualcomm's ultrasonic fingerprint sensor stands as a remarkable engineering achievement. Not only can it capture high-resolution fingerprint images swiftly, but it also excels in challenging conditions like wet or oily surfaces and in complete darkness, thanks to its ultrasonic imaging capabilities. Moreover, its energy-efficient design is so optimized that the sensor can double as a power switch for the device, further enhancing its practicality.

Security Considerations

While Qualcomm claims the 3D imaging capabilities of their sensor enhance biometric security, I have some skepticism, particularly concerning the depth imaging. The employed reconstruction algorithm is fairly basic, which brings into question the sensor's resistance to spoofing techniques. This skepticism seems to be supported by existing evidence. Indeed, a brief search led to a report detailing a successful spoofing attack on a similar ultrasonic fingerprint sensor using a 3D-printed finger [4]. Given these factors, the actual security efficacy of Qualcomm's sensor remains an open question.

Future Applications and Hackability

Given its high-volume production and intricate engineering aimed at a specific problem, Qualcomm's sensor is a compelling candidate for other innovative applications. While the sensor is currently designed for fingerprint scanning, one could envision hacking the device to explore further into biological tissues, potentially repurposing it as an ultrasonic tomograph.

The present architecture, if sufficiently modified, could provide much-needed capabilities for 3D imaging in medical applications. Currently, the sensor focuses on a shallow layer of the skin to read fingerprints. However, with alterations in the excitation pulses and the readout strategy, the sensor might be capable of imaging deeper tissue structures.

To turn this into a reality, the sensor's readout would need to be modified to sample each PMUT at higher frequencies, enabling more sophisticated beamforming techniques for imaging. The challenge here would be in the high-speed, high-resolution data acquisition that proper beamforming would require.

Admittedly, such a modification would not be straightforward. These sensors are highly optimized to serve their primary function of fingerprint scanning. Yet, the concept of repurposing a mass-produced, sophisticated piece of hardware like this for medical imaging or other scientific applications is tantalizing. It would certainly require a deep dive into the sensor's architecture and capabilities, but the payoff could be monumental, offering a low-cost solution for more intricate imaging needs.

References

[1] Tang, Hao-Yen, et al. "3-D ultrasonic fingerprint sensor-on-a-chip." IEEE Journal of Solid-State Circuits 51.11 (2016): 2522-2533. https://ieeexplore.ieee.org/abstract/document/7579196
[2] System Plus Consulting Report https://s3.i-micronews.com/uploads/2019/07/SP19465-YOLE_Qualcomm-3D-Sonic-Sensor-Fingerprint_Sample.pdf
[3] YouTube Video https://youtu.be/JeTm5sd8ktg?t=143
[4] Spoofing attack https://www.digitalinformationworld.com/2019/04/samsung-galaxy-s10-ultrasonic-sensor-fingerprint.html

Time-Gating for 7 Frames with a Digital Micromirror Device

Introduction  

The paper titled "Diffraction-gated real-time ultrahigh-speed mapping photography" ([2]) presents a method for capturing seven distinct frames at an ultra-fast speed.

Method  

The study employs a Digital Micromirror Device (DMD), a MEMS-based technology featuring an array of tiny mirrors that can toggle between two orientations at high speeds. Placed in the back focal plane of an imaging system, the DMD produces seven diffraction orders, essentially creating seven copies of the input image.

All mirrors in the DMD array tilt synchronously. During transitions from an "all-off" to an "all-on" state, this synchronous tilt yields a dynamic phase profile. This results in the diffraction envelope sweeping through the seven diffraction orders.

Equation 1 outlines the DMD's diffraction pattern:




This equation describes the intensity of a point target observed in the intermediate image plane. Two sinc functions modulate the diffraction orders: one depends on the width of individual mirrors and the other on the width of the device. The time-dependent element here is the instantaneous tilt angle θb of the mirrors.

Note: A potential error could be the cos(mπ) term located outside the sum over m.

Performance metrics indicate a frame interval of 0.21 us ± 0.03 us, corresponding to 4.8 million frames per second.

Applications  

While capturing just seven consecutive frames may seem limited, there are intriguing applications. Given the short integration time, the method requires either high light power or multiple cycles of the DMD mirrors. Potential applications include:

  • Analyzing the ablation patterns of pulsed lasers
  • Investigating the spatial distribution of light modes in a moving multi-mode fiber
  • Studying transient changes in photonic integrated chips, such as superluminescent diodes or lasers with modulated gain sections

References  

- [1] AJD-4500 DMD Controller https://ajile.ca/ajd-4500/
- [2] Optica Paper https://opg.optica.org/optica/fulltext.cfm?uri=optica-10-9-1223&id=538060
- [3] Hacker News Discussion https://news.ycombinator.com/item?id=37523314