A Survey on Limitation, Security and Privacy Issues on Additive Manufacturing

In general, every additively manufactured parts is affected by the process family and the device used to build the components. Process specification includes the general material deposition method, the principle of bonding, methods of re-coating. These determine the types (i.e., polymer, concrete, etc.) and nature (i.e., solid, powder, etc.) of the raw materials. Machine-specific capabilities and limitations also include several materials. At the industry level, a particular machine can only operate on unique contents. The minimum build resolution (generally in x, y, and z-axis) and build dimension (also in x, y, and z-axis) can vary from material to material. Process-wise faults like unintentional internal voids, blind holes can present due to wrong material choice. This problem can be solved by monitoring the post-processing level and quit if there any faults showing in manufacturing levels. These types of fundamental limitations could be removed by building the parts in another machine.

Since the revolution of the AM in industrial sectors, multiple manufacturing, and production design guides have published. Those guides typically focused on process specification guidelines, machine constraints, and considerations. In 2015, materialise [10] published 19 design guides for a variety of materials. Each design provides precise information about the materials like minimum wall thickness, minimum detail size, maximum part size, expected accuracy, and those considered as ‘design specification.’ Stratasys published three guides mentioned DMLS [11], FDM [11] and laser sintering, which are sets of ‘basic rules, tips, and tricks’ for process and material specific. Each guide includes several general specifications like supported and unsupported wire thickness, wire size, maximum and minimum bounding box, a minimum size of the escape hole for entrapped material, the expected outlook of the material, and the expected accuracy.

Lastly, 3D systems published two design guides, both focusing application-specific considerations for brass [12] and plastic SLS components [11]. Those two guides include features like internal channels, assemblies, springs, hinges, threads, and snap fits. Adam and Zimmer presented a catalog of design rules that include laser melting, laser sintering, and FDM, which addressed geometric constraints like element transitions, sharp edges, feature spacing, and unsupported features [13].

Learning design rules/guidelines is an advantageous starting point. But they do not provide general information about individual machines and their capabilities. So, when the detailed information is required to support the design and manufacture products, a benchmark is the most crucial factor to study and compare AM processes. In the beginning, AM benchmarks introduced for comparison, selection, and process optimization. They were relatively large features and can quickly characterize. With the progress of design and processes, AM benchmarks gained more ‘specific’ characteristics (i.e., holes, wall thickness, angles, notches, bosses, towers, excellent features, etc. [14]).

For AMs, in many cases, raw materials can be used without any modification, and some elements need to be adopted before they apply for manufacturing production parts. Some materials and design specifications need to be changed at every stage of production with the manufacturing needs change from stage to stage. Like, laser sintering gold requires a change in the alloy to prevent material evaporating [15]. Also, the material properties of the final parts can be a part of modification in AM processing. Material properties affect the use of recycled raw materials and the recycling process. So, the potential degradation in quality associated with the cost and waste of the manufacturing materials.

Though AM brings an excellent prospect for the industrial production for the design purposes, it has a significant issue for the quality control beyond the output. Verification of materials, geometries, and surfaces is one of the problems related to post-product quality control. It is very challenging when AM creates geometry and the part material at the same time. At the end of the printing process, it is urgent to check undesirable characteristics, unintentional internal voids, and defected porosity in the bulk material. For the functional content, those challenges go higher, and it is required to fix the optical and mechanical property characteristics before the product goes for marketing.

Additive manufacturing requires complex design and a very high level of data processing. For those, there have been several challenges for the entire process. The first and most crucial challenge about the present specification system, which defined in the ISO [16], is that AM could not cover complex freedom shapes. There also have some requirements for the communication system [17] at the time of manufacturing. There does not exist much significant work in this area until this time. The manufacturing designers need to keep in mind that the first stage choices of the design have a substantial impact on the production and the quality control of the manufacturing process. So, the basic design related to quality control and metrology is a part of AM.

AM can be handy for the medical and aerospace industry. But, these two industries are highly regulated, and every newly manufactured product always require regulatory approval. So, it is a vital and urgent need for the designers to test, verify, and document all the process of manufacturing to get regulatory approval. As AM industry does not have much historical data, obtaining regulatory approval is one of the significant challenges. Currently, AM primarily applied in the military sector for the betterment of military aircraft than commercial aircraft [18]. Parts related to commercial aviation is very sensitive compare than military aircraft. Without safety testing and regulatory approval, the AM industry can’t manufacture new pieces for the business jets.

In the medical sector, there has been a very significant improvement for AM. Recently, researchers from the Tel Aviv University of Israel created a 3D-printed heart model, and they printed that model with blood vessels using patient’s cells. That was the very first 3D-printed human organ. There have been a significant number of medical devices printed using 3D printing technology, and they are now providing service in several medical institutions all over the world. If a patient permits to perform any experiment for medical purposes that should name as ‘single-use experimental’ basis experiment and that permission is called ‘explicit medical consent’. Those uses are limited in numbers compare to other medical device uses. Though, a large number of hip implants gained the approval of the regulatory committee in recent years.

As AM is rapidly growing and becoming very popular day by day, adversaries may try different ways to manipulate and endanger the manufacturing process. Researchers are always trying to find flaws to fix and improve the AM industry. From the beginning of designing the 3D model to the final print of that model, one crucial media that always needed to be maintained is printing software or otherwise known as firmware. In recent times, there have been several findings of severe complications of the 3D printer software. In 2016, Moore et al. [19] gave a vulnerability analysis of desktop 3D printer software. They analyzed a set of desktop 3D printer software to identify potential attack vectors. A basic set of analysis tools were used for their work. Their dynamic analysis of USB communication shows vulnerability in transferring packet data between desktop to a 3D printer, and for this monitoring, they used a device monitoring system. Their specific set of 3D printer software includes Cura 3D, ReplicatorG, Repetier-Host, and Marlin Firmware. They used VCG, RATS, Scitools, Fortify, and DMS analysis method to analyze that software. For Cura 3D software, RATS found occurrences of fixed buffers in global variables and use of uncontrolled strings. VCG found memory management issues (i.e., use of sscanf can be susceptible to buffer overflows). That issue can crash the system due to lack of resources. Scitools found a variety of coding style issues, and that includes code variable without comments and the dead code. But, not a direct effect that permits attacks but can hinder further developments. Log forging, path manipulation, command injection, unreleased resources, xml injection, location of dependent comparison, and null deference were found in ReplcatorG software. VCG reported some issues like unreleased resources, lack of exception handling, and getting the path from variable for ReplicatorG. Those issues can lead to file mishandling, integer overflow, and denial of service for the lack the resources. Files and functions that were too long or highly complex have some issues found by Scitools. For Repetier-Host software, VCG found three problems. They were improper thread locking, use-time/resource check-time race condition, comments in potential unfinished code. The authors found unreachable code, over-long functions, over-long files located in Repetier-Host using the analysis of Scitools. In Marlin firmware, the authors [19] found two issues (i.e., use of strcat and fixed global buffers). Incorrect use of those two can lead to a system crash. VCG discovered integer overflows for strlen and signed/unsigned comparison. Scitools reported dead code and variable without any comment.

The authors of [19] found another major flaw in dynamic communication between Repetier-Host and the 3D printer itself. 3D print always completes with the G-code command from the host. But, there are no authentication or encryption media used in transferring the G-code from the host to the printer. So, an adversary can quickly get the plain text of the G-code. The authors found the G-code could be modified at any end by the adversary to damage the final print, which can cause a significant hazard in the printer.

In 2017, their follow-up work [20] have shown the additive manufacturing industry about the implication of malicious firmware. They provide an example of ”G-code packet capture” to capture format of the G-code, unmodified control loop, and process command function. They mentioned two categories of attack strategy and vulnerability. First one is the modification of the commands from the host, and the second one is the modification of the variable that will increase the extrude rate and create an unintentional hazard.

In AMs, there are three categories of attack targets: the environment, the manufactured part, and the AM equipment [22]. An attack on AM could affect other equipment and machines nearby. If electrical components are compromised, then it could damage the whole device. Attack on the manufactured part could harm the final assembly. Embedding a defect in a rotating part at a predetermined speed has been already documented [6]. A manufactured part could be affected by an altercation in the process and in-process characteristics. Unexpected material could be introduced to the primary material to contaminate the manufacturing process and thus, the manufacturing object.

AM equipment itself can be a target of attack. Mechanical components like powder handling equipment, the extruder of a 3D printer, seals, re-coating system, and various other part are vulnerable to the physical attacks. Electrical components like sensors, motors, power supplier, interlocks play a critical role in the manufacturing process. Likewise, mechanical parts, attacks relating to electrical components of AM devices can cause irreparable damage.

From an adversary viewpoint, additive manufacturing is one of the prime sectors to exploit in the present time. As the inclusion of AM technology becoming more and more popular over the traditional manufacturing process, it became a prime target for the security experts. In this portion of our survey, we will present several attack methods on the additive manufacturing process.

Xiao et al. [23] first presented in a keynote session at XCon2013 about the effect of attacks on Desktop 3D-printer. In that session, Xiao Zi Hang gave the idea that ’printing results,’ including the size of the print object, material strength, printing layers, and position of the components, might change through an attack. He mentioned about the modification in software or configuration, object description or the firmware, etc. With the change or rewrite the code in the RepRap3D printer’s firmware converts the print bed or extruder temperature twice than the temperature set by the G-code in the main module.

Faruque et al.  [24] presented the first paper related to producing the sound of a stepper motor of a 3D printer. The authors showed how acoustic emanations could be ’tied-back’ to the actual movement of the stepper motors. Based on this, researchers can reconstruct the 3D printed object. Based on the recorded sound, they were able to restore the 3D print model with the accuracy of 78.35$\%$, which which could cause damages to the intellectual property of authentic manufacturers.

In [25], the follow-up work of [24], the authors focused on thermal side channel. They used an infrared camera to capture the image, and based on image analysis; they tried to identify individual 3D printing process activity, for example, nozzle movements. The goal of the paper was to reconstruct a fully 3D printed model. They used the video feed to estimate test-bed motions by using an algorithm which they developed. They also used a mapping algorithm to transform the images into nozzle and base plate activity. The camera used for capturing the video feed was a low quality (50 Hz, non-auto focus, 640 x 480 resolution) single, fixed viewpoint. So, they assumed that a camera with higher quality would bring improvement in the accuracy of the algorithm.

In 2016, a side-channel attack against a wide variety of additive manufacturing components, which generally constructs and forms the object introduced by Hojjati et al. [26]. Acoustic and magnetic side channels used in the attack were recorded by a compromised cell phone. After the analysis of the recording, the authors found that the tape can reconstruct the movements of the manufacturing equipment. For the line segment length, the reconstruction is accurate within one millimeter and one degree for the turning angle of the machine. The authors proposed an audio obfuscation or audio confusion method to block this type of attack. In the counter of the attack, they play the audio recording to other slightly changed manufacturing sessions. The loss of the harmonic is not the way to defend against this type of attack as the adversary can easily track the damage and find out the real recording.

Song et al. [27] proposed an attacking strategy that is similar to Faruque et al. [24] in terms of acoustic emission. But there are several differences between those works. Firstly, in [24], they used a professional audio recorder to record the audio. But, in [27], the authors used sensors available on smartphones. Secondly, instead of using a single side channel, the of [27] used magnetic and acoustic emanations. This approach has a more precise result rather than the previous one. The reconstruction model has only 5.87$\%$ error with this approach.

Gupta et al. [28] demonstrated anti-counterfeit system based on compensatory manufacturing conditions and pairing defecting model features. Printer configured without material removal of embedded model results in a void or filled with support material in the final output. Such voids can create a defect and result in fracture under strain.

Yampolskiy et al. [29] identify that Internet Protocol or IP is not limited to 3D printed object geometry alone. 3D object geometry also requires manufacturing parameters and properties like operational parameters of a part. The authors also proposed an outsourcing model which provides service to the customers by the AM manufacturers and can depend on the IP manufacturing parameters. Third-party can give the IP manufacturing parameters.

Do et al. [30] analyzed two popular 3D printers; the MakerBot 3D printers and the Replicator (and the mini version of Replicator). Both the printers connected from the host via WiFi, USB, or Ethernet. In the analysis of the communication of the networks, the authors found the adversary on the local network can easily retrieve the previous 3D print models. So, they further investigated and found that user’s authentication code and client secret are not encrypted. These credentials could be used to send separate commands from the host to the printers to perform unintentional jobs.

Ilie et al. [31] covered a lot about the failure for altering the parameters in the printing process. They showed that manipulation in the laser power and exposure time create layers with increased porosity in the building part. These layers become more vulnerable in the presence of stress. The authors showed deformation, and strategic failure for the manipulation. Above mentioned attacking strategy is the same as the sabotage attack.

Slaughter et al. [32] presented indirect sabotage on AMs. The authors showed that false reading for the sensors and the feedback loop in the existing process could be compromised. For AM metal with powder bed fusion (PBF), they showed an analysis about the attack could lead to the adjustment of the laser with false estimation and position of the laser either too high or too low than the expected position for the printing. Incorrect laser positioning and errors in laser strength lead to lack of porosity or higher porosity in the final printed object. This lead to defects, and the printed object is vulnerable to mechanical stress.

Ding et al. [33] published a paper in 2015, which presented the idea against the future attacking possibility and future interest in wire-feed additive manufacturing technique.

Bayens et al. [34] considered a threat model in which either the host PC or printer firmware compromised. When similar kind of objects manufactured multiple times, they proposed a three-layer framework for replication verification. So, the process does not depend on G-code. It actually depends on the replication of the object using acoustic, spectroscopic, and gyroscopic replication verification. They verified the system and proposed a model by printing a tibial knee implant. The environment of the printing process should be noise-free to have the perfect sound for the acoustic measurement. They also mentioned the model could improve the performance using combined data acquisition as gyroscopes to have a higher degree of errors.

Chhetri et al. [35] proposed a model for cross-domain attacks and cross-domain defense approaches for AM. The authors introduced Cross-domain security. Their proposed model covers a variety of security purposes for the manufacturing process. The model can work for: 1) determining information leakage, 2) abnormal behavior determination in the physical domain, 3) prediction of component and system failure, and 4) analysis of cross-domain attacks.

In 2015, Hou et al. [36] presented a 3D printing watermarking model that can survive the re-scanning process and 3D printing. A digital watermark is a kind of marker covertly embedded in a noise-tolerant signal such as audio, video, or image data. Each layer has an exterior in the x-y plane with the normal vector. An embedded watermarking model extracted with surface scanning and a histogram of each layer could produce. Cho et al. [37] performed several tests and was able to find out two printed models out of the four printed models by using the histogram analysis.

Vincent et al. [38] proposed a system that includes piezoelectric transducers (PZT) to measure the impedance and to distinguish between altered and unaltered parts to a manufactured part. The authors argue that the existing quality control (QC) system was not adequate to detect the sabotage attacks. That’s why they introduced the PZT. Maintaining key quality characteristics (KQC) of a product generally is the best way to manage and control the quality of a product. The authors provided a scenario where modification of design file created an additional hole in the car body frame and thus reducing the strength of the mechanical property. The introduction of PZT showed a significant improvement in the context of a structural health monitoring system and for the work of Sturm et al. [39].

Kennedy et al. [40] proposed a solution for the counterfeit detection for the fused deposition modeling (FDM) 3D printing process. Every non-altered polylactic acid (PLA) used to print 3D part, while custom parts used to write a unique QR code. QR code generates a chemical signature, and the authors proposed to store these signatures as block-chain entries and searchable references.

Belikovetsky et al. [41] exploit acoustic side-channel to detect attacks on FDM desktop 3D printer which is similar kind of work performed by Bayens et al. [34] and Chhetri et al. [35]. The authors used an analysis process called Principal Component Analysis (PCA) to generate and compare the generated audio signal in a 3D printing process. The validity of the follow-up prints compared by using the signature of the prints against the genuine. They defined a set of activities like insertion, deletion, modification, or reordering in single G-code command. They determined a threshold in the process under which they considered a change in the process in a minimal second. This process is reliable to check abnormality like filament extrusion.

Sturm et al. [39] proposed a system in which they mentioned the coupled piezoelectric sensor influences part material. In a process, small fabrication can be easily measured using the sensor and for the impedance variance already affected layer can also be detected. Other prints verified for the production using the recording of the original signature or baseline signature. The authors claimed the detection of layer change with the help property called sensitivity. However, sensitivity could increase if the material density is high and decrease if the mass is lower. Also, it changes with the position of the sensors from the material at the time of production.

Straub et al. [42] proposed image-based fault detection and security in 3D printing. Their initial work used five different angles to track the printing process using the pixel image [43]. Changes in camera position, background, angle changes are the most common factor for the degraded image. So, adapting the similar kind of way the authors went for defect detection, use of incorrect print materials and mispositioned prints. Rather than the initial computational analysis, the proposed method worked as practical applications rely on human operations in the manufacturing process. Print-Material detection is limited to changes in color and the reflectively of the object.

DeSmit et al. [44] proposed an intelligent manufacturing vulnerability assessment approach to work with the NIST framework [45]. The manufacturing process is a set of entities that connects each item of the collection with the others. Human operations, cyber-physical design tools, physical resources, and equipment assessed adequately in process activity. The authors claimed that most of the vulnerabilities have occurred on the connections of those entities. The assessment set some self-directed questions for the manufacturer in terms of vulnerability measurement and labeling vulnerability as low, medium, or high, along with some significant criteria. In a follow-up paper [46], the authors provided a case study that showed this approach could identify vulnerable node for an independent attack. A CAD file of a jet engine bracket has been modified by the attack exposed the flaw of the assessment. The offense designed with the awareness of the test plan but the testing was unable to detect the attack.

Tsoutsos et al. [47] proposed an approach to detect internal structure integrity defects. Their system had two stages. First, they used a compiled tool-path (G-Code) representation to approximate the object which needs to be print. Secondly, they used Finite Element Analysis (FEA)  [48] to simulate the performance of the printed model under various stress condition. The simulation of FEA returns a color-coded image illustrating any overstressed area. After the observation of the print object and the simulation of the model, manufacturers can determine whether the output model meets the requirement of manufacturing or not.

Turner et al. [49] conducted a study to identify additive manufacturing attack surfaces. Manufacturing toolchains contain several attack vectors that exploit easily. The authors mentioned that generally, there is no secure and authentic way that design files transferred without any types of modification. Design files usually transferred from designers to the manufacturers or users via e-mails or via USB devices. So, they concluded that design files generally incorporate no security measures and thus design files lack integrity. It is also impractical to rely on the quality control process to verify part’s integrity as that process is not enough to detect cyber attacks.

For the FDM printer printed parts, Belter et al. [50] presented a paper. They introduced a way named ’fill composition technique’ to show how FDM printed manufacturing parts can be strengthening. This method was the first method to counter against the attacks on FDM printed parts.

In additive manufacturing, the intellectual property might be affected by the act of several adversaries. In 2014, Yampolskiy et al. [29] presented the idea of protection of intellectual properties for the additive layer manufacturing. The paper was first to introduce the intellectual property protection related to layer upon layer manufacturing. The authors examined problems on additive manufacturing, and they introduced a new outsourcing model of additive layer manufacturing-based production.

For new 3D-printed MEMS magnetometer with optical detection, Khar et al. [51] proposed a prototyping approach and verification method. Sensitivity measurement with such magnetometer devices indicates high accuracy and excellent structural performance.

As the AM industry is comparatively new, few people are aware of the legal aspect of AM sabotage. This section surveys those publications which might provide the basis of future explicit discussion of AM sabotage legal aspects.

3D printing services (3DPS) are considered as liability target. Wang et al. [52] described design defect determination by risk-utility analysis. Consumer expectations, risk, and utility formed his analysis. Major concerns, according to the authors, are whether the 3DPS provide a product without knowing the CAD file details. The authors finished their article by providing information about using the wrong material on the final product, providing legal defense to other actors.

Product liability for recovery theories were proposed by Malloy et al. [53]. While strict liability applies for the commercial sellers and distributors, negligence is applicable for the non-commercial 3D printer uses. The author’s discussion of the topic distinguished between the source of defect and the manifestation of the fault. The nature of additive manufacturing sets the applicability of a particular claim as not as a law. Two instances are the determination of the standards to apply for warnings and instructions and the determination of weather an actor is involved commercially for strict liability to apply. The paper did not discuss the applicability of product liability following a duty to inspect the product that had already been altered by a third party.

A micro-seller category had been proposed for the ”occasional” producer and manufacturer enterprise by Berkowitz et al. [54]. They analyzed the applicability of negligence and breach of warranty and their related defenses. The authors proposed retaining strict liability for 3D printing but creating a new affirmative defenses for the micro-sellers. Berkowitz argued doing so meets the social policies of balancing protection with fairness.

In 2017, Chua et al. [63] presented some basic standard for the 3D printing process, and the authors also presented some criteria for quality control. They also enlisted problems related to industrial production of additive manufacturing.

Industrial security issues have a significant impact on the manufacturing process. Lipton et al. [64] first presented the idea of additive manufacturing for the food industry. With the concept of additive manufacturing, health hazard also came in mind of the manufacturers. The inclusion of materials which could be dangerous for the health issue came into consideration at that time. An adversary can affect food production and cause material discrepancy for food products, which could easily affect the human body.

We discussed several security issues with the production fault and how it could affect the manufacturing product with the stress. First, production fault addressed in 2015 by Huang et al. [65]. They discussed the gaps in industrial sectors and gave potential recommendation for the differences that were present at that time.

In the medical sector, the AM technology have significant contribution in recent years. Ventola et al. [66] first presented uses of 3D printing in medical industries and also projected the idea for future users. Gerstle et al. [67] showed the concept of three-dimensional printing in plastic surgery application. Gibson et al. [68] presented the simple idea behind the making of the surgeon into a 3D designer. They provided the idea of how the surgeons can design according to patients need and manufacture 3D-printed objects using the design. Fitzpatrick et al. [69] presented patient-specific 3D-printed arm cast design. In recent times, researchers are also able to generate workable 3D printed human heart from human tissue. 3D-printing also can be used in neurosurgery. Pucci et al. [70] presented the idea of 3D-printing in neurosurgery and by far extent, they provided limitations also. Limitations of 3D-printing or AM in the medical sector is severe rather than mechanical limitations. For the limitations of 3D-printing or additive manufacturing in medical sectors, a huge number of patients life can endanger if the application of the 3D-printing is not correct. In recent time, doctors tend to prescribe 3D-printed artificial legs for the persons who might have lost their leg for accident or other reason. But, in some cases, it is common that, those 3D-printed medical applications are not able to provide the best for the patients. Some of them lack the usefulness of a printed part as a whole.

From this survey, we have enlisted and discussed major potential flaws in the manufacturing process of additive manufacturing. From the study and discussion, we have come with some critical observations on AM and manufacturing process in terms of security and efficient manufacturing.