Embedded system copy protection - Page 1
Forum section: electronics / projects

author: silent
author_rank: Contributor
timestamp: May 13, 2014, 01:05:26 pm
content: Hello.I am currently developing a system with an ARM microcomputer running Linux and a custom PCB with user interface (display, keyboard, etc) with UART interface. I would like to protect the project from being copied by some little stealing bastards or at least make it much more difficult.Has anyone already done this before or have any idea how to do this?I could implement some asymetric cryptography on the custom board and ask for a key in my application, but it does not protect against pulling out the SD card and cracking the app.Any other ideas? Maybe some hardware security chips?

author: amyk
author_rank: Super Contributor
timestamp: May 13, 2014, 01:19:35 pm
content: It's probably not worth as much as you think it is... there's always a crack.

author: dannyf
author_rank: Super Contributor
timestamp: May 13, 2014, 01:21:59 pm
content: As long as you can encrypt, others can decrypt so it is futile.Having said that, you can try a few things:1) most of those chips have unique IDs. Use that as a key;2) turn on code protection;3) obfuscate the entry point;4) insert multiple check points in the code;5) once a copy is invalidated, do a full chip erase.

author: NiHaoMike
author_rank: Super Contributor
timestamp: May 13, 2014, 02:06:00 pm
content: Probably doesn't apply in your case, but if it has Ethernet or other network interface (and is likely for multiple units to be used on one network), have the copy protection revert the MAC address to some default value a few months after it detects a pirate copy. The pirate would probably copy the code as-is (except for the MAC address), sees that it works, and ship it. A few months later, some very strange problems occur as the devices all revert to the default MAC address.One way to do that is to cryptographically sign the MAC address and hide the signature away from the MAC address. Put the MAC address in an obvious place so that the pirate would go for it and trigger the hidden copy protection mechanism.

author: Kjelt
author_rank: Super Contributor
timestamp: May 13, 2014, 02:30:43 pm
content: If it is worthwile for somebody to hack it (usually this means $$$$$) then there is no way of stopping them yet with normal ARM microcontrollers since there are companies that can and will rip/copy the firmware.The only thing that can be any good of the tips mentioned above is indeed as DannyF states using the chips unique ID and let the bootstrap routine for the first time it runs ever (in your own factory that is) obfuscate part of some critical algorithm with that uniqueID (encrypt it or white box obfuscate it with part of the solution being the unique ID) , and thus modify the firmware itself making each firmware only capable of being run on that specific microcontroller.That being said if that firmware is still copied and the unique ID known of the original chip, the hacker can debug the code and still reverse engineer the right code.Very frustrating but untill the microcontroller itself will have an internal encryptionkey and encrypt the firmware there is little to do.

author: free_electron
author_rank: Super Contributor
timestamp: May 13, 2014, 03:05:42 pm
content: Completely embed the board in potting compound. Use a small lithium battery inside the compound and trickery like photodetectors and conductivity detectors.Try to remove the potting compound by milling : light gets to it.Dissolve : conductivityOn trigger : erase flash.

author: scientist
author_rank: Frequent Contributor
timestamp: May 13, 2014, 06:14:34 pm
content: Sand off the chip labels? Then you're just a dick...

author: Legit-Design
author_rank: Frequent Contributor
timestamp: May 13, 2014, 06:19:23 pm
content: Take some hints from credit card terminals? Some already mentioned here.Don't use SD card, just use one of those chips that are soldered but act exactly like SD cards. Hide the tracks on internal layers. The more you obfuscate the more someone might like the challenge and publish their findings.

author: NiHaoMike
author_rank: Super Contributor
timestamp: May 13, 2014, 08:11:49 pm
content: I think that making it look deceptively simple to copy but with a hidden trap that takes a long time to show up (like the MAC address reverting I mentioned earlier) would keep the pirates from putting much effort into making the copy, thus increasing the chance they'll ship flawed copies.

author: Mechatrommer
author_rank: Super Contributor
timestamp: May 13, 2014, 11:52:43 pm
content: Quote from: Legit-Design on May 13, 2014, 06:19:23 pmthats called a newbies. the pro one they dont care as long as they get what they want. and being famous is one thing that they will avoid number one.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: May 14, 2014, 11:12:21 am
content: Something that most people miss, is to include an easy way to prove that something is copied - e.g. a secret keypress combination that displays your company name (stored obfuscated of course).You need to look at your potential market to figure out where the risks are, and address those risks.There are a number of crypto devices that you could include on your board that could for example do a challenge/response type thing, but if someone can get at the code, they could just bypass these.You also need to ask yourself how hard would it be for someone to recreate the same product - if you have some super-clever unique algorithms etc. that distinguishes your product it may be worth spending some time on protection, but otherwise you may be wasting time that you could be using for development, or causing support/end-user problems when security features get in the way.

author: eurofox
author_rank: Unknown
timestamp: May 14, 2014, 11:35:37 am
content: Quote from: silent on May 13, 2014, 01:05:26 pmA micro switch on the cover of the housing, a battery and 2 Kg of TNT, I promise they will not try to copy anymore and your developement is safe ....

author: SeanB
author_rank: Super Contributor
timestamp: May 14, 2014, 06:44:12 pm
content: That does work, and I have taken those apart. Very interesting, and a pretty impressive cloud as well.

author: Legit-Design
author_rank: Frequent Contributor
timestamp: May 14, 2014, 07:00:34 pm
content: I guess shipping 2Kg of TNT is more safe than shipping lithium batteries too. Have you ever heard of TNT explosion in the post office? Where as lithium batteries are notoriously dangerous and explicitly forbidden.

author: diyaudio
author_rank: Frequent Contributor
timestamp: May 14, 2014, 07:04:16 pm
content: Quote from: silent on May 13, 2014, 01:05:26 pmNot worth the effort, if commercial key protections (HASP) are not up to the task what is so special about your design ?

author: SeanB
author_rank: Super Contributor
timestamp: May 14, 2014, 07:16:03 pm
content: Quote from: Legit-Design on May 14, 2014, 07:00:34 pmYou have obviously never visited Ireland, the UK, Libya, Lebanon, Israel, Iran,Iraq, Pakistan, Afghanistan, Angloa, Namibia or South Africa then, where that has been a somewhat frequent occurrence.

author: Towger
author_rank: Super Contributor
timestamp: May 14, 2014, 07:32:19 pm
content: TNT... Sentex or a fertiliser, powered aluminum and diesel mix is what they use here.

author: Kjelt
author_rank: Super Contributor
timestamp: May 14, 2014, 08:41:02 pm
content: Your all joking butI heard back in the 80s a story from an EE ( but still can not verify if it is true) that US military radio equipment from the korean war had electrolytic looking capacitors that were filled with explosives to go off if they were opened in a wrongfull way. The intension was to prevent the enemy from listening in with copied equipment.Those radios ended in military dumps and cost some civilian radio amateurs their lifes. Anyone that can verify this or proof it was a hoax? Anyway that was the cold war.

author: silent
author_rank: Contributor
timestamp: May 14, 2014, 09:43:50 pm
content: Thanks for the replies!The problem is that due to low volume production we will be using off-the-shelf ARM computer with very simple custom extension board, so the it could be copied by buying the same board, cloning the SD card and copying the UI board on the breadboard or universal PCB in an hour. There's no rocket science in this project - it could be recreated by only knowing it's functionality and of course, everything can be reverse engineered and cloned, but I don't want to make it possible without any effort.A challenge-response communication with my custom board (AVR 8-bit MCU with flash protection) and maybe some small code obfuscation seems to be a good option - relatively small amount of work and satisfactory level of protection.Filling the case with concrete would be a nice solution too - it would remove the feeling of a light weight Chinese crap product ;-). Our new model will be called "The Brick"!Quote from: Legit-Design on May 13, 2014, 06:19:23 pmNice one!Btw. last month i have seen the board with fake labels printed on some chips. 8-pin DC/DC converter connected directly to MCU's IOs with only a decoupling cap looks a little strange. In your face, b*tch! ;-)

author: Kjelt
author_rank: Super Contributor
timestamp: May 15, 2014, 07:30:24 am
content: Well next time don't make the same mistake again: security should be a requirement of the project from day 1 not one popping up at the end of the projectAt the end of your project your options are very limited.