INVITED: ObfusCADe: Obfuscating Additive ManufacturingCAD Models Against Counterfeiting

Nikhil Gupta1, Fei Chen1, Nektarios Georgios Tsoutsos2, Michail Maniatakos31Composite Materials and Mechanics Laboratory, Mechanical and Aerospace Engineering, New York University,

Brooklyn, NY 11201 2Computer Science and Engineering, New York University, Brooklyn, NY 11201 3Electrical andComputer Engineering, New York University Abu Dhabi, UAE

{ngupta, fc954, nektarios.tsoutsos, michail.maniatakos}@nyu.edu

ABSTRACTAs additive manufacturing (AM) becomes more pervasive, its sup-ply chains shi� towards distributed business models that heavilyrely on cloud resources. Despite its countless bene�ts, this para-digm raises signi�cant concerns about the trustworthiness of theglobalized process, as there exist several classes of cybersecuritya�acks that can undermine its security guarantees. In this work,we focus on the protection of the intellectual property (IP) of 3Ddesigns, and introduce ObfusCADe, which is a novel protectionmethod against counterfeiting, by embedding special features inCAD models. �e introduced features interfere with the integrityof the design, e�ectively restricting high quality manufacturingto only a unique set of processing se�ings and conditions; underall other conditions, the printed artifact su�ers from poor quality,premature failures and/or malfunctions.

KEYWORDSAdditivemanufacturing, cybersecurity, cyber-physical system, threatmodels, CAD modeling, fused deposition modeling, 3D printing

1 INTRODUCTIONAdditive manufacturing (AM), also known as 3D printing, refersto a computer-controlled layer-by-layer material deposition pro-cess for creating 3D objects. Contrary to traditional manufacturingmethods, such as machining, milling, and forging, that are largelysubtractive and rely on material removal from a large feedstock,AM allows creating any shape with complex internal 3D structureand geometries. �e numerous advantages of AM, justifying itscontinuously increasing adoption, include a high degree of poten-tial customization for printed parts, reduction of manufacturingcosts by eliminating dies, molds and other tooling, or the require-ment for assembly (which is prone to design and manufacturingtolerance mismatch), as well as reduction of shipping costs dueto just-in-time, on-site manufacturing [12]. �ese bene�ts makeAM ideal for almost all manufacturing industries including medical,automotive, and aerospace, where notable examples include 3Dprinted jet engine parts [3], bespoke medical implants and arti�cialorgans [5], as well as car parts [17].

Permission to make digital or hard copies of part or all of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor pro�t or commercial advantage and that copies bear this notice and the full citationon the �rst page. Copyrights for third-party components of this work must be honored.For all other uses, contact the owner/author(s).DAC ’17, June 18–22, 2017, Austin, TX, USA© 2017 Copyright held by the owner/author(s). 978-1-4503-4927-7/17/06.DOI: h�p://dx.doi.org/10.1145/3061639.3079847

�e impact of the AM industry has already become visible, grow-ing to about $6 billion in 2015, with a 26% annual growth rate, and itis expected to continue at the same rate in the near future [21]. �eAM �eld is expected to grow into a $20 billion market by the year2020 according toWohlers Report 2016 [21]. In addition, since AM isa cleaner, and more sustainable manufacturing technology, mediumterm projections set the economic impact of AM at around $550billion per year by 2025 [1]. As the cost of owning and maintainingAM equipment continues to decrease [2], even small businessescan create their own micro-factories to design and manufacturephysical artifacts [13]. O�en dubbed as the next industrial revo-lution [15, 18], AM is disrupting the manufacturing industry, andas it continues to be embraced, its economic and societal impact iscompared to this of the Internet [19].

At the same time, one important security concern in AM is thediversity of distributed business models, wherein trusted, partiallytrusted or potentially untrusted parties are engaged at di�erentstages of part manufacturing. �is model introduces several cyber-security risks, ranging from intellectual property (IP) the�, coun-terfeiting and overproduction, to poor print quality, manufacturingdefects, reduced strength and premature part failure, or contami-nation [11]. �e inherent di�culty of validating trust in the AMsupply chain draws natural comparisons to contemporary supplychains in the integrated circuits (ICs) industry [8], which mirrorsthe range of threat scenarios that are also applicable to AM. Hence,before being able to protect against supply chain a�acks, it is neces-sary to understand the cybersecurity risks applicable to AM, classifypotential a�acks and identify applicable protection strategies.Our contribution: Another important observation about the AMprocess chain is that IP and counterfeiting threats are fundamen-tally di�erent from threats causing manufacturing defects, strengthreduction or poor quality, as IP the� does not necessarily alter aphysical or material property that can be tested or measured. More-over, the unbounded �nancial loss associated with counterfeitingmakes such a�acks more impactful compared to others. �us, toaddress the family of threats related to IP the�, in this work wepropose ObfusCADe, a novel protection methodology that obfus-cates the design of a 3D model (also known as a CAD model), andensures that the corresponding part is manufactured correctly onlyunder certain conditions of processing the CAD �les and printing.

Using ObfusCADe, we are able to “sabotage” an original CADmodel by judiciously embedding design features that will mani-fest as defects, unless certain manufacturing conditions are met.Our observation is that we can exploit inherent properties in thestereolithography (STL) representation of 3D models, as well asthe material deposition for di�erent CAD processes, to masquerade

1

Figure 1: A typical AM process chain: CAD designs are iteratively optimized through FEA before conversion to STL. �e latter is sliced andsent to (cloud-aware) printer �rmware controlling the physical printer. Finally, the physical artifact is tested for integrity and quality.

Figure 2: Taxonomy of attacks in additive manufacturing.

Figure 3: 3D artifact stages (clockwise from top-le�): CAD model,FEA model optimization, model slicing and G-code tool path, STL�le conversion.

how a legitimate and defect-free artifact can be printed, in light ofIP the�. �is approach can be viewed as the AM analogy of “logiclocking” [10], which protects the IP of integrated circuit designsby adding extra gates (only here we add extra design features). Afurther bene�t of our ObfusCADe protection strategy is that itallows identi�cation of genuine parts by checking the presence orlack of these embedded features.

�e rest of the paper is organized as follows: in Section 2 wedescribe the distributed, cloud-aware AM process chain and discussthe associate risks and mitigations for each step. �en, in Section 3we elaborate on our novel obfuscation methodology for CAD mod-els and present our experimental results. Finally, our concludingremarks are discussed in Section 4.

2 PRELIMINARIESCloud-aware process chain: As illustrated in Fig. 1, a typicalprocess chain for AM comprises several steps, where teams lo-cated in di�erent parts of the world can collaborate on each step[11, 20]. In addition, leveraging the continuous advancements indistributed computing, modern AM process chains have heavy de-pendence on cloud resources [14]. During the �rst stage of thisprocess chain, called computer-aided design (CAD) modeling, sev-eral design teams use special so�ware (for example, SolidWorks) tocreate a 3D representation of a physical object. �e la�er is itera-tively optimized with respect to mechanical, thermal and physicalproperties through �nite element analysis (FEA), computational�uid dynamics (CFD) or multiphysics analysis, before a qualifying

variant is produced. �en, the CAD design is exported to a printer-independent stereolithography (STL) �le format, which representsthe 3D object as surface areas de�ned using triangles (Fig. 3).

To convert the STL representation into a stack of 2D layers, aslicing so�ware is employed by the teams. �is step generatesprinter-speci�c instructions using a special encoding (“G-code”) tode�ne the movement coordinates for the AM printer head (i.e., the“tool path”) required to build each slice on the 2D plane. �e G-codetool path is ultimately sent to the cloud-aware printer �rmware thatparses each command and drives the corresponding printer actua-tors. Common examples of AM printing techniques include FusedDeposition Modeling (FDM), Stereolithography (SLA), SelectiveLaser Sintering/Melting (SLS/SLM) and Polymer Je�ing (PolyJet) [9].As soon as the physical artifacts are printed and before assembly,a representative sample undergoes destructive or non-destructivetests and inspections to ensure quality standards.Risks & mitigation: �e distributed nature of the AM processchain makes it vulnerable to a number of cybersecurity a�acks,which can be summarized in the taxonomy of Fig. 2. �ese at-tacks can a�ect all system abstraction levels, from the physical (i.e.,material composition), to the electromechanical parts (e.g., actua-tors) and the logical parts of the system (e.g., �rmware, �le storage,or so�ware). In addition, since several entities in the system areconnected to the cloud, unauthorized external access may lead tocorruption of so�ware tools, �les or databases, as well as exploita-tion using Trojans or design tampering, which can ultimately causeartifact contamination, printer damage or poor performance. Sincethe AM process chain may be producing high-value physical com-ponents (such as jet engines [3]), the impact of such a�acks canbe devastating. Likewise, if the exploitation leads to informationleakage, con�dential IP designs may be used to print counterfeitartifacts, leading to revenue loss or reputation damage. Moreover,in case adversaries have physical access to the system running theprinter �rmware, additional a�ack vectors are possible: for example,if access ports such as USB are exposed, adversaries may connect to

2

Table 1: Cyberecurity risks during di�erent stages of the AM supply chain

AM stage Description of applicable cybersecurity risks Potential risk-mitigation strategies

CAD model& FEA

• IP the�, ransomware, so�ware Trojans, malware• CAD libraries & FEA databases corruption/modi�cation• Malicious insider corrupts CAD model, adds vulnerabilities

• Data-Loss Prevention so�ware, code reviews, periodic backups• CAD-level design obfuscation for IP protection (this work)• IP �le access/integrity controls, entitlement reviews

STL �le• Removal/addition of tetrahedrons (i.e. voids/protrusions)• Dimension & ratio scaling, shape changes, end point changes• File the�/loss/corruption, ransomware

• Review 3D rendering/�le contents/manifold geometry errors• Veri�cation of digital signatures, �le sizes/hashes• Strict access control to �les, regular backups

Slicing &G-code

• Orientation changes, addition of porosity/contaminants [11]• Damage to printer actuators using malicious coordinates• IP the�/reverse-engineering, reconstruction of CAD model

• Simulation of generated G-code (e.g., [20]), code review• Actuator limit switch preventing physical damage• Periodic review of printer parameters, strict access controls

3D Printer

• Malicious �rmware updates, unauthorized remote access• Activation of �rmware Trojans, malicious operator• Acoustic/thermal side channels, IP the�, information leakage• File parser/�rmware zero-day, corrupted calibration �les

• Strict access control, network �rewalls, secure updates• Inspection of printed object, measurement of weight/density• Tensile strength test, X-Ray/Ultrasound/CT scan reconstruction• Side-channel shielding, noise emission, physical access controls

Testing• Detection granularity versus test time trade-o�• Low CT/ultrasonic equipment resolution

• High resolution CT/ultrasonic tests on random samples• Use higher resolution equipment, test over di�erent angles

Figure 4: Tessellation induced gaps: a tensile test specimendesignedwith spline split feature exported to STL format, showing gaps in-duced by tessellation along the spline due tomismatch between ver-tices of the triangles across the spline.

Figure 5: Meaning of STL resolution parameters.

the system, force unauthorized updates, install backdoors or setupa covert communication channel.

To mitigate the cybersecurity risks associated with the afore-mentioned a�acks, several mitigation strategies may be leveraged.As summarized in Table 1, a variety of security controls can be usedto minimize the a�ack impacts: from traditional cryptographicprimitives such as encryption, hashing and digital signatures, toaccess control policies and information security management prac-tices, such as entitlement reviews and regular backups. In addition,process speci�c mitigation, such as high-resolution and multi-angleartifact testing, limit switch protections or code review and geome-try error checks can also help detect cybera�acks. Likewise, ourObfusCADe protection methodology (Section 3), can help mitigateAM counterfeiting and IP the� risks.Information leakage attacks: Using side-channel emissions fromthe electromechanical components of AM printers, it is also possi-ble to leak information about the manufactured design. As demon-strated in [4], a smartphone in close proximity to an FDM printer,can detect acoustic and magnetic emanations, and eventually recon-struct G-code tool paths with relatively small error. Similarly, the

authors of [16] use machine learning classi�ers to reconstruct ob-jects being printed on an FDM printer using acoustic side channelsand showcase the risk of IP the� a�acks.

3 PROTECTION METHODOLOGY AGAINSTCAD MODEL COUNTERFEITING

�e AM process chain presented in Fig. 1 shows that the originalCADmodel goes through a chain of conversions to di�erent formats.Loss of information may take place during these conversion steps[6]. For example, the information may be lost while convertingfrom CAD to STL format and between slices in the slicing step. Inaddition, parameters such as print speed, time delay in depositingsuccessive layers and printer resolution in x, y and z directionsneed to be considered throughout this process chain in order toobtain the desired quality of �nal product [7]. Although theseconsiderations make it challenging to obtain a high-quality product,they also present opportunities to develop features that can be usedfor security and identi�cation of genuine products. �e hypothesisis that in the presence of intentionally introduced features, themodel should print in high quality only under a speci�c set ofprocess �ow and printing conditions without compromising thequality of the genuine product. All other conditions should providea defective �nal component that will have an inferior service lifeor a di�erent printed structure. �e examples presented here areparts of simple geometries designed to demonstrate the clear e�ectsof the features embedded in the geometry. Moreover, industrialcomponent designs are o�en complex and integrating the proposedsecurity features may be easier in complex geometries. Below theCAD-based security strategies are introduced with their designmethodologies and realization process. �ese security features cancause disruption to the �nal product quality and geometry if theprescribed manufacturing process is not followed in the exact order.

3.1 Spline split feature�is work demonstrates the use of design features such as splitsurfaces in CADmodels for security purposes. A spline (curve) splitfeature creates a massless separation inside a single body. �e splitfeature cuts through the middle of a standard tensile test bar, where

3

Figure 6: Printing orientations in this work are de�ned as x-y andx-z.

the length of spline (21mm) is 3.5 times the width of the tensile bargauge section (6mm). In the CAD �le, two bodies are formed withinone single part due to the presence of the spline, with zero distanceor volume separating them. Next the CAD �le is exported as an STL�le. Several di�erent STL resolutions are possible during �le export.�e �ner resolutions use a greater number of triangles to representthe geometry and result in larger �le size. A representative modelexported using the “Coarse” resolution se�ing in SolidWorks isshown in Fig. 4. �e di�erence in the tessellation along the splinein two parts of the geometry results in mismatch at the corners oftriangles located at the spline, as shown in the magni�ed views.

An investigation into implementation of the spline split featurein FDM printed components is performed on di�erent combinationsof STL resolutions and printing orientations. Fig. 5 presents threeexport se�ings of CAD �le to STL format. “Coarse” and “Fine”resolutions are preset options in SolidWorks, while the “Custom”se�ing can provide the highest resolution bymanually adjusting theAngle and Deviation permi�ed for a curve to the smallest possiblevalues. �e two printing orientations of the specimen used in thiswork are de�ned in Fig. 6.

�e STL �le is imported into slicing so�ware to generate theG-code �le containing the 2D tool paths. �e Preview function inthe slicing so�ware allows visualization and navigation of the 2Dtool paths generated for each layer of the 3D model. �e same set ofslicing properties are used for preparing the tool path for printingthroughout this work including 0.01778 cm layer resolution, solidmodel interior, smart support �ll, and STL unit of millimeters. Usingthese slicing properties, the models oriented in x-y and x-z printingorientations show di�erent slicing results. When oriented in thex-y direction, the sliced model does not show discontinuity or othersigns indicating the existence of the split. Further, models saved inFine and Custom STL resolution show similar slicing results underx-y orientation. It is therefore expected that tensile bar modelswill not be printed with discontinuity under x-y orientation for allSTL resolutions. However, when the model is placed and slicedin x-z orientation, discontinuity around the spline feature can beobserved for all STL resolutions as in Fig. 7a. �e presence of adiscontinuity in the sliced model makes it likely that the featurewill also appear in the printed specimens.

�e CAD models are 3D printed using a fused deposition model-ing (FDM) based Stratasys Dimension Elite 3D printer. �is printercan print a model material (ABS) and a dissolvable support material(SR-10TM / P400SRTM Soluble Support Material-acrylic copolymer).Reference models (standard tensile specimens without a split fea-ture) are also printed under both printing orientations to comparewith the spline split models. Models printed in x-z and x-y ori-entations are shown in Fig. 7 and Fig. 8, respectively. Unlike theresults observed in sliced models, the printed specimens show that

(a) (b)

Figure 7: �e tensile test specimendesignedwith spline split feature(Coarse STL): (a) sliced model along x-z orientation, (b) 3D printedin x-z orientation on an FDMprinter using thermoplastic �laments;inset shows the presence of spline in the printed model.

(a) (b)Figure 8: Tensile test specimens (a) designed with spline split fea-ture and (b) intact (without the spline split) 3D printed by FDMprinter under x-y orientation. Both models are processed usingCoarse STL setting.

Coarse STL resolution �le printed in x-y orientation has a surfacedisruption but in a less regular shape compared to x-z direction asin Fig. 8a. Higher STL resolutions can minimize or even neglect thisdisruption, leaving the surface texture same as intact samples inFig. 8b. However, when printed in x-z orientation, the spline splitfeature is printed for all three STL resolutions. Increasing the STLresolution does not seem to help in eliminating the discontinuityalong the spline in the samples printed in x-z orientation.

�e results obtained on the FDM printer are then replicated ona material je�ing printer (Stratasys Objet30 Pro) using VeroClearmaterial. �e Objet30 Pro is capable of printing parts with a mini-mum layer thickness of 16 µm, as compared to 178 µm for the FDMprinter used previously. Similar results are obtained in terms ofpresence or absence of the spline feature with respect to the STLresolution and print orientation even for the resin printer, providinga broader context for these results. It can be concluded from boththe ABS thermoplastic specimens and the VeroClear photopolymerspecimens that the spline split feature impacts the model integritywhen printed.

Embedding the spline feature in the standard tensile test speci-men allows testing the specimens to obtain quantitative measure-ment of the mechanical properties in the presence and absenceof the split feature. �erefore, tensile tests are performed on fourgroups of 3D printed specimens under the same set of slicing prop-erties. �e summary of tensile properties is given in Table 2, where“Spline x-y” and “Spline x-z” refer to specimen designed with splinesplit feature printed in x-y and x-z orientations, respectively; “In-tact x-y” and “Intact x-z” refer to the reference specimens with nospline split feature printed in x-y and x-z orientations, respectively.For both directions, ultimate tensile strength and Young’s modulusare comparable between intact and spline split samples, but theaverage failure strain for spline split samples is at least 50% lessthan the intact samples. Similarly, the toughness of intact samplesis at least twice that of the specimens containing the split. Fig. 9shows that the fracture initiates at the tip of the spline causing pre-mature failure of the specimen and results in the lower measuredtoughness.

4

Figure 9: Tensile failure originated at the tip of the spline due tothe stress concentration, which results in the lower measured prop-erties.

Table 2: Tensile properties of specimens containing spline split fea-ture 3D printed by FDM printer. Intact samples are tested for refer-ence.

Property Spline x-y Spline x-z Intact x-y Intact x-zYoung’s

modulus (GPa) 1.89±0.04 2.10±0.05 1.98±0.05 2.05±0.03Ultimate tensilestrength (MPa) 24±1.1 31.5±0.5 30±0.2 32.5±0.3Failure strain(mm/mm) 0.015±0.001 0.021±0.001 0.029±0.001 0.077±0.041Toughness(kJ/m3) 295.4±94.2 453.6±29.5 632.1±33.2 3367.4±902.8

�e example presented in this section is a standard tensile testspecimen with simple geometry. Real engineering designs o�eninclude complex and multi-component systems that include manycurves, lines, surfaces, and construction lines. Addition of oneor more surfaces for security and identi�cation purposes in suchcomplex models is possible with minimal chance of detection. Inaddition, such features can overlap or cut across other design fea-tures for obfuscation. Variations of such features based on the sameprinciple can be developed to use in di�erent designs. �ese fea-tures work independent of cybersecurity tools implemented on thenetwork and on �les, or identi�cation codes and marks to guardagainst duplication from stolen �les.

3.2 Embedded features�e previous example has a surface embedded across the entirespecimen width and thickness to divide it into two parts. In thepresent example, a body is entirely enclosed inside a second body.

3.2.1 Embedding sphere without material removal. A 3D modelis created in the shape of a rectangular prism of dimensions 2.54 ×1.27×1.27 cm3 (1×0.5×0.5 in3) with an embedded sphere of radius0.3175 cm at the center. �e sphere is created as an embeddedfeature directly inside the solid rectangular prism without anymaterial removal. In one model, the sphere is created as a solidand in the other model, the sphere is created as a surface geometry.Visualization of both CAD models is similar as shown in Fig. 10a.Both models are then exported to STL (using Fine resolution) tounderstand how the surface feature would be treated di�erentlythan the solid feature when converted to STL. A rectangular prismmodel without any embedded sphere is also created for comparison.Introducing the embedded sphere makes both CAD and STL �lesizes larger than the intact prism model. Meanwhile, it is noticedthat though the CAD �le size for surface sphere and solid sphere isdi�erent, the STL �le size is the same.

�e slicing properties used in the previous example are also usedin CatalystEX to slice the STL models of this example. �e resultsare shown in Fig. 10b. �e red slices are the tool path to build the

(a) (b)

(c) (d)

Figure 10: (a) Exported STL model of rectangular prism with anembedded solid sphere and (b) sliced �le showing tool path formodel designed with embedded sphere, which is seen in both sur-face and solid sphere without material removal. 3D printed rectan-gular prism designed with embedded sphere feature cut in half (c)showing spherical support material printed and (d) showing a com-pletely solid prism printed with no support material inside.

model, while the white tool path slices of the support material aregenerated underneath all models to provide support on the buildplate. �e model and the support tool paths generated for surfaceand solid sphere models have the same appearance in the so�ware.

3.2.2 Embedding sphere with material removal. In this test case,an empty spherical space is created in the solid prism in the �rststep. In the next step, either a solid or a surface sphere of the sizeof the cavity is embedded at the center of prism. Introducing thesphere makes both CAD and STL �le sizes larger than the intactprism model. Meanwhile, it can be noticed that though the CAD�le size for surface sphere and solid sphere is di�erent, STL �leinformation is the same. It is observed that embedding a spherewith material removal creates a larger size �le than embedding asphere without any material removal. In addition, the solid spheremodel and surface sphere models have similar visualization in CADand STL �les. �e STL �les are then sliced to generate tool paths. Inthis case, the solid sphere feature is no longer recognized as emptyspace by the program and the model is expected to print as a solidrectangle, while the sphere feature is preserved in the tool path asin Fig. 10b.

3.2.3 E�ects on printed parts. FDM printed models of a spherecontained inside a rectangular prism are shown in Fig. 10c and10d for models processed under various conditions. Fig. 10c showsthat with material removal in the CAD step, the surface spherefeature is printed as an empty space and �lled with support material.�is is the same printing result for both solid and surface spheresembedded without material removal in the rectangular prism. Fig.10d shows that with material removal, the solid sphere feature isprinted the same as the solid intact rectangular prism. Table 3provides a summary of the printing results for the four models withor without material removed containing solid or surface sphere.

5

When converting a part �le into an STL �le, the conversionprocess consists of taking the surface geometries and breakingthe surface into many triangles. �e STL �le also stores a normaldirection for each triangle to determine the boundary between theoutside and inside of the model. �e normal is used to determinewhere the 3D printer will lay out material to build the part. Whenthe STL �les are supplied to the 3D printer, the printer depositssupport material where the sphere is present for both STL �les. �esupport material can be washed away, resulting in a hollow spacewhere the sphere is located.

An embedded geometry within a solid introduces an additionalsurface; additional triangles are required to represent this modelwhen exporting it as an STL �le. As a curved surface, a sphererequires a large number of additional triangles to represent itssurface. �e triangulation occurs only for the surfaces of the modeland since the size of the sphere is kept the same in the surface andsolid sphere �les, there is no di�erence in the number of trianglesbetween the two STL �les.

A solid sphere without material removal results in sphere printedwith support material. With the material removal operation, modelmaterial is printed for solid sphere while support material is printedfor surface sphere, even though both models exhibit the same STL�le properties. Use of obfuscated design features in a componentcan help in con�guring the model in such a way that the embeddedfeatures can print as defects and reduce the life and performanceof the component.

4 CONCLUDING REMARKSIn this work, we analyze the distributed, cloud-based process chainof modern additive manufacturing ecosystems, along with the cy-bersecurity risks and a�acks applicable to each stage of this process.Our focus is counterfeiting and piracy that can cause �nancial lossesand reputation harm to the IP owners. To prevent this family ofa�acks and mitigate the risk of IP the�, we proposedObfusCADe, anovel methodology that allows obfuscating an original CAD modelby introducing special features that prevent high-quality manufac-turing of the 3D geometry, unless certain conditions for printingand processing of the CAD �les are met. Speci�cally, when thesespecial conditions are not met, the manufactured artifact will bedefective, as the presence of our embedded features in the �nal partreduces its quality and performance. Our methodology is furthersupported by experimental results obtained on two example sys-tems, where the �rst example shows use of a 2D surface and thesecond example shows an embedded 3D surface feature in a solidmodel. Both examples show that the model is printed in high qual-ity only under a speci�c set of process �ow conditions. �e samedesign philosophy can be applied to develop additional features foruse in solid models for the purpose of security.

ACKNOWLEDGMENTS�e authors thank NYU for providing institutional fellowship toFei Chen to work on this project, as well as the NYU Abu DhabiGlobal Ph.D. Student Fellowship program for supporting NektariosG. Tsoutsos. �e authors also acknowledge the resources providedby the Center of Cybersecurity at NYU Abu Dhabi. NYU GlobalSeed Grants for Collaborative Research to Gupta and Dr. Khaled

Table 3: 3D printing results for four rectangular prism models de-signed with di�erent CAD processes and features. All models areexported at Fine STL resolution.

CAD Operation CAD spherefeatures

Material printed forsphere feature

Without materialremoval

Solid Support materialSurface Support material

With materialremoval

Solid Model materialSurface Support material

Shahin is acknowledged. Dr. Jeyavijayan Rajendran with the ECEDepartment of University of Texas at Dallas is thanked for his inputin earlier versions of the provided a�ack taxonomy. NYU TandonMakerspace is thanked for printing the parts.

REFERENCES[1] D. Cohen, M. Sargeant, and K. Somers. 2014. 3-D printing takes shape. h�p://

www.mckinsey.com/insights/manufacturing/3-d printing takes shape. (2014).[2] Rinnovated Design. 2016. �e Peachy Printer - �e First $100 3D Printer &

Scanner! h�ps://www.kickstarter.com/projects/117421627/the-peachy-printer-the-�rst-100-3d-printer-and-sc. (2016).

[3] General Electric. 2017. Additive Manufacturing. h�p://www.ge.com/stories/advanced-manufacturing. (2017).

[4] C. Song et al. 2016. My Smartphone Knows What You Print: ExploringSmartphone-based Side-channel A�acks Against 3D Printers. In CCS. ACM,895–907.

[5] D. A. Zopf et al. 2013. Bioresorbable Airway Splint Created with a �ree-Dimensional Printer. New England Journal of Medicine 368, 21 (2013), 2043–2045.

[6] K. Tata et al. 1998. E�cient slicing for layered manufacturing. Rapid PrototypingJournal 4, 4 (1998), 151–167.

[7] M. Asadi-Eydivand et al. 2016. E�ect of technical parameters on porous structureand strength of 3D printed calcium sulfate prototypes. Robotics and Computer-Integrated Manufacturing 37 (2016), 57–67.

[8] M. Tehranipoor et al. 2010. Trustworthy hardware: Trojan detection and design-for-trust challenges. Computer 7 (2010), 66–74.

[9] M. Yampolskiy et al. 2014. Intellectual property protection in additive layermanufacturing: Requirements for secure outsourcing. In Program Protection andReverse Engineering Workshop. ACM, 1–7.

[10] M. Yasin et al. 2016. On improving the security of logic locking. IEEE Transactionson Computer-Aided Design of Integrated Circuits and Systems 35, 9 (2016), 1411–1424.

[11] S. E. Zeltmann et al. 2016. Manufacturing and security challenges in 3D printing.JOM 68, 7 (2016), 1872–1881.

[12] I. Gibson, D. Rosen, and B. Stucker. 2015. Additive Manufacturing Technologies: 3DPrinting, Rapid Prototyping, and Direct Digital Manufacturing (2nd. ed.). Springer.

[13] J. Horvath. 2014. Mastering 3D printing. Apress.[14] ISO/ASTM52900 2015. AdditiveManufacturing –General Principles – Terminology.

Standard. ISO, Geneva, Switzerland.[15] H. Lipson. 2011. 3D printing: �e technology that changes every-

thing. h�ps://www.newscientist.com/article/mg21128236-100-3d-printing-the-technology-that-changes-everything/. (2011).

[16] et al. M. A. Al Faruque. 2016. Acoustic side-channel a�acks on additive manu-facturing systems. In International Conference on Cyber-Physical Systems. IEEEPress, 19.

[17] Local Motors. 2017. Strati 3D printed car. h�ps://localmotors.com. (2017).[18] S. Rega. 2014. How 3D Printing Will Revolutionise Our World.

h�p://www.businessinsider.com.au/the-next-industrial-revolution-is-here-3d-printing-2014-8. (2014).

[19] S. Sedghi and E. Hall. 2015. 3D printing will have a bigger economic impact thanthe internet, technology specialist says. h�p://www.abc.net.au/news/2015-04-01/3d-printing-impact-bigger-than-internet-expert-says/6365296. (2015).

[20] N. G. Tsoutsos, H. Gamil, and M. Maniatakos. 2017. Secure 3D Printing: Recon-structing and Validating Solid Geometries using Toolpath Reverse Engineering.InWorkshop on Cyber-Physical System Security (CPSS ’17). ACM, 1–6.

[21] T. Wohlers. 2016. Wohlers Report 2016: 3D Printing and Additive ManufacturingState of the Industry. Wohlers Associates.

6