Protecting your intellectual property - Page 1
Forum section: electronics / general

author: ColdKeyboard
author_rank: Contributor
timestamp: February 12, 2015, 04:36:50 pm
content: I was wondering if someone could share their experience or point me to some good reading material on protecting your intellectual property from being copied.Let's say you use MCU that is available to the public domain, and you want to protect your design from being copied. Now I am not worried about someonedoing copy&paste of my PCB, that's OK. What I don't want is for someone to dump data from the MCU, burn it to another MCU and make 1000 of copies.I guess you could use MCU with the unique ID laser etched onto the dye so you can check if the ID has changed. Also there is a EEPROM with the UID, that can be hashed and storedinto the EEPROM memory and later on you can check if the hashes match.I understand that there is no 100% way of protecting your hardware, I just want to make sure it's not worthwhile for someone to spend time and $$$ on breaking my hardware.I would love to hear more on this topic and what are your opinions about it. Also if you have some reading material to recommend, I would appreciate it!

author: ovnr
author_rank: Frequent Contributor
timestamp: February 12, 2015, 04:56:24 pm
content: The likelihood of anyone bothering to copy your hardware if you're just making small quantities of it is really, really low. Also consider pricing the item fairly; if you sell something with a BOM cost of $5 for $500, there's way more incentive to knock up a clone.Other than that, it depends on the MCU and how determined your attacker is. PICs have code protection flags that pretty effectively prevent reading out the code, while an old 8051 with external EPROM... doesn't. At the end of the day, no matter how well protected the chip is, you can just de-cap it and wipe some config fuses, and voila - your chip is readable again.Just checking if a on-chip serial number matches the program memory is pretty pointless tho, it's super easy to scan the program for reads of the serial number, and just replace the whole security routine with nop's.At the end of the day, there is no perfect protection, and you probably don't need it. Go spend the time making your product better instead!

author: nctnico
author_rank: Super Contributor
timestamp: February 12, 2015, 05:02:21 pm
content: Most modern MCUs have copy protection. Enable that and you'll be pretty safe. Don't spend too much time on copy protection; time is better spend on making your product better or cheaper.

author: AndyC_772
author_rank: Super Contributor
timestamp: February 12, 2015, 05:03:49 pm
content: I'm inclined to agree, you only need to make your product secure enough, so that it's more effort to copy it than it would be to reinvent it in the first place. The more novel, inventive and creative your code, the more work it's probably worth doing.Is the MCU code a major part of the product, or is it just a part of a larger system that would be harder to copy? If so, it may not be worth worrying about at all. Or if you sell into a limited market, in which your company and the support it offers are valuable in their own right, then there may not be a market for copies.

author: Jeroen3
author_rank: Super Contributor
timestamp: February 12, 2015, 05:06:57 pm
content: You can go all-in:- Read/Write protection.- JTAG disable fuses (destroys jtag interface inside the chip)- Mill over the chip package texts.- Put your board in polyurethane pur.- Have tamper protection wipe the AES key of your AES encrypted program. (You'd need a chip capable of running AES code for that)- Get a custom silicon.All other than the above 2 will cost you extra money.

author: mazurov
author_rank: Frequent Contributor
timestamp: February 12, 2015, 05:41:21 pm
content: You can also open source everything. If your product has any value it will be copied no matter how hard you try to protect it; by open sourcing you put cloners in a position when they compete with each other rather than you.If you decide to go this route you need to think about ways to differentiate yourself from cloners - provide support, fw updates, maintaining community, etc. For more ideas look at what FOSS people are doing.

author: Sbampato12
author_rank: Regular Contributor
timestamp: February 12, 2015, 06:06:10 pm
content: Weller do not protect their PICs.Even doing this, they are one of the leaders on segment...You, or mainly, industry, will not only buy the clones (they exist, at least here) just because 'it is the same circuit, even the firmware'...it is way beyond that.But if you want/need to protect the code, as people already told, just blow up the config fuses (of modern MCU). It is pretty unhackable (there is not such a thing, but it come closer).To reverse engineering a MCU (or memory) you will need much effort, and expense equipaments, that make it cost money that in most cases is more or equivalent to pay to make a new one.

author: Jeroen3
author_rank: Super Contributor
timestamp: February 12, 2015, 06:23:28 pm
content: It also depends on the industry branch.Consumer electronics are more likely to get copied than industrial devices.This because of the liability of industrial devices that will go missing if you use cheap clones.Most consumers do not care about this. And that is why Apple has such a hard time keeping their lightning cable,theircable. But PLC cables are still expensive.If you get injured by an Apple charger, you can sue apple. If you get injured by a chinese clone, you can knock on the door of the insurance office.The same goes for the Saleae logic guys. Selling a logic analyzer for a three digit sum, with a fancy milled aluminium case. While some chinese sell clones with similar hardware, but lacking fancy case, for 10% of the price. (probably also cloned IC's)But the cloned one does not have any guarantee to meet spec.Not considering clones, ip might be worth to protect anyway. Your algorithm's might be the last piece the competitor is missing to make their product better.But this starts with the people, not with read protect.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: February 12, 2015, 06:33:31 pm
content: Quote from: ovnr on February 12, 2015, 04:56:24 pmThat is extremely dependent on your target market. "fair " pricing is about the value of the item to the customer, not just the BOM.QuoteMost MCUs' onboard protection can be broken for a few hundred dollars by sending it to various dodgy people in China.

author: zer0
author_rank: Newbie
timestamp: February 12, 2015, 07:53:02 pm
content: MCU copy protection does not provide protection against a determined attacker.I should know, because I am one of those attackers. To be more specific, my job is reverse-engineering (for security analysis though, not for cloning). Where I work, we have yet to come across a non-security-specific (IE, expensive) MCU for which we could not break, bypass, or otherwise exploit the built in anti-readout measures.There are other, less ethical, attackers (such as those mentioned by mikeselectricstuff), that have the same kinds of tools and knowledge that we do. Pretty much your only hope is to increase the cost of attack to the point that it is not worth cloning your product, or to make sure that the value of support and ancilliary services is such that people will not buy a non-genuine product.As others have mentioned: Definitely utilize whatever tamper protection mechanisms your chip comes with, just don't count on them to stop anyone that is determined.If it helps ease your mind: for all the products I've seen that I know can be broken easily, I've yet to see one cloned, simply because the value isn't there.

author: ColdKeyboard
author_rank: Contributor
timestamp: February 12, 2015, 11:28:25 pm
content: I am more than aware that you can't protect your device from the determined attacker. The goal is to protect your hardware enough that it's not worthwhile for someone to reverse it.Also in my opinion going open-source is the best way to go but that's not the topic here.So you are saying that PIC code-protection is working when it comes to reading the device data and dumping it to another device.Any other suggestions and best practices? I just don't want for someone to copy the PCB, order the same MCU and dump the data from one MCU to other and voila, they have a "free" working copy.

author: ovnr
author_rank: Frequent Contributor
timestamp: February 12, 2015, 11:54:44 pm
content: Quote from: mikeselectricstuff on February 12, 2015, 06:33:31 pmI suppose "fair" is the wrong word to use. But it's still valid; if there is a $500 product that can be cloned for $5, it's much more lucrative than a $7.95 that can be cloned for $1. Of course, many niche markets are less susceptible to cloned products.Quote from: ColdKeyboard on February 12, 2015, 11:28:25 pmYes, most MCUs offer "enough" protection to stop a casual attacker, but if the attacker is willing to spend a few hundred bucks, you can't do much about it.Also consider how high a risk you're actually seeing; if you make 1k units and spend $3 to secure your product (potting, for instance - not that it helps much either), that's a net loss of $3k, regardless of if anyone clones it or not. Are you willing to spend that on the off chance it stops - or more likely just slows down - an attacker? And for a few grand, an attacker can easily afford to either reverse-engineer (including firmware extraction) your product; there should be little economic incentive to spend more money on protecting it than it would cost to defeat said protection.

author: Rasz
author_rank: Super Contributor
timestamp: February 13, 2015, 03:05:12 am
content: Quote from: mikeselectricstuff on February 12, 2015, 06:33:31 pmcame here to say thisThere are people., for example on the MESS mailing list (MAME emulator offshoot emulating PC hardware), specializing in reading masked rom stuff. They are crazy to the point of emulating sound cards by decapping intel 8051 controller (sound blaster 2.0), reading back the rom, and emulating 8051 doing emulated DMA transfers on emulated ISA bus from emulater ramin the name of bug for bug compatibility.

author: vk6zgo
author_rank: Super Contributor
timestamp: February 13, 2015, 03:57:22 am
content: You probably havenointellectual property when it comes to the actual hardware,unless you designed & made all the devices yourself.Normally,the only part you need to,orcanprotect is the software/firmware,which is the product of your thought processes.I worked at a place where they wouldn't let us have schematics because we might disclose their IP to outsiders.This made it quite difficult to fault find their "Main board".When they finally relented,we found it was basically a big interface board,(full of public domain circuitry),with all the actual "smarts",being in several PCs.The only thing worth protecting was their software,which WAS quite brilliant stuff!

author: Howardlong
author_rank: Super Contributor
timestamp: February 13, 2015, 08:15:10 am
content: I have two anecdotes.On one device I released the hardware and software source to individuals encourage interest in a particular area. I spent a lot of time on it and had boards made up. A not-for-profit organisation with interests in the same area also used the IP to make a few quid with my blessing: I am not sure how much they have made, but it's become the standard device to use in that niche market, but I'd hazard a guess it's a 6 figure sum so far. They reinvest the proceeds in supporting that area of interest. Sadly, a commercial outfit also saw fit to pinch the entire design and sell it as their own without any form of acknowledgement.The second device I developed used an ASIC with an NDA attached, and so I used the code protection on the MCU (a PIC) to protect that. In addition I only thought it would sell a hundred or so, and I wasn't looking for it to make a living out of it. However, it became a runaway success, with tens of thousands sold, and it did indeed become my living. I quit my day job as a result.About six months after the product was released, I received a series of emails from someone claiming to have broken the code protection (and I am sure they did) and who wanted lots of information about the device so they could make the firmware better than I'd done. The problem with this scheme is that it meant breaking the NDA, and that I'd have to spend a lot of my time justifying my own design decision to an individual who I didn't even know the name of, and describing the four board revisions so they could hack something together. Now for a time I did consider working with them, but they would not disclose the method they'd used to crack the firmware other than to say they'd used methods documented online. The "relationship" quickly soured as it became clear this was going to be very much a one way street. Had the individual been more honest and open with me from the start, it might have worked.The device has been copied many times, although they are not clones, just the idea has been copied, and I am fine with that. I didn't patent anything, and there's a good reason for that. For an international patent, you are looking at a six figure sum, an awful lot of your time, it takes a couple of years to be granted, by which time it's too late, the world has moved on. And even if you did have a patent and someone copies your idea, the cost of successfully implementing a cease and desist is just not viable unless you have a lot of patience, time and money.Anyway, the long and the short of it is that you should endeavour to spend resources on what differentiates your device from any other to give value, and resist spending too much time in copy protection. The retail cost to BOM cost argument does indeed hold some water, but it is not the whole story: the cost of R&D is not included in that. I have one product I've been working on for three years, it may still yet come to nothing. But that is a lot of R&D time to pay for. Equally I see some stuff coming over from China in particular where you can't even buy the parts in volume for what they charge retail for a finished units, that can only be as the result of end-of-line or liquidation, and you can't run a business like that.

author: Mechatrommer
author_rank: Super Contributor
timestamp: February 13, 2015, 09:49:19 am
content: Quote from: ovnr on February 12, 2015, 11:54:44 pmmaybe offtopic but i think related... consider open source fw code like.... reprap 3d printer. how many clone/turnkey 3d printer out there using this osfw? i think almost everything. now i know "open source" is different, its legal to do so. my point is the more open it is, the more susceptible it is to be exploited/cloned regardless by whom, big or small or personal business/personal. some manufacturers even already scrubbing their chip numbering, we dont get it why? i think copycat problem is for real, not just 100% copycat, but copycat from studying (reverse engineering) a particular board, it is much faster and cheaper to learn from existing board or "intellectual property" rather than learning from theory in schools. protecting your "intellectual property" is a very valid move imho, no matter how simple it is at least we tried, something is better than nothing. we know that nothing is unhackable but at least we made one or several steps harder for the theives. you are not theif doesnt necessarilly mean others arent. it doenst happen in your world doesnt necessarily means in other region also the same. for me, copy protect the fuse if that the only thing you know, if somebody hack it thats another story, but at least we tried.edit: another example... salae logic niche?, arm/fpga/avr programmer, hakko iron, canon/nikon remote flash triggering system, thats what i know i'm sure many other examples.edit: and err i forgot... rigol 50MHz dso, making 70,100MHz version useless. i dont know if its intentional or unintentional leak... but its good to have 100MHz at 50MHz price...

author: vk6zgo
author_rank: Super Contributor
timestamp: February 14, 2015, 03:28:29 am
content: If you really want to alienate your customers,make a simple but vital product & sand the top off the devices used.When you are on the other side of the world,& the Boss is screaming at you to get the thing going,it is hard to care about the manufacturer's I.P.Once you know what the thing does,it is usually possible to reverse-engineer it,but it is annoying & time consuming.

author: Howardlong
author_rank: Super Contributor
timestamp: February 14, 2015, 09:16:55 am
content: Quote from: vk6zgo on February 14, 2015, 03:28:29 amWhile I agree that scrubbing the chip numbers does little more than delay the inevitable, it sounds that your predicament has more to do with lack of planning at a management level. Perhaps I misunderstood, and I apologise if I did, but it sounds as if your company's business became dependent on a device but had no plan in case of a failure, or alternatively an appropriate service level with the vendor.While I feel your pain, I am not sure that having a screaming boss, particularly when they have failed to plan, is a reasonable place to work.

author: hans
author_rank: Super Contributor
timestamp: February 14, 2015, 12:09:52 pm
content: Quote from: mojo-chan on February 13, 2015, 11:11:45 amIndeed.An instant brick that goes into like:Code:if (ObfuscatorFunction(ChipSerial) != FirmwareImageSerial){for (;;)}Is not going to hold up well. They can probably load up the image in a debug mode, halt when it bricks and see instantly that this code is responsible for the hang, and see what part of the image closely affects it.Instead I would silently corrupt the stack or (vital) program results, lose settings data, let it hang in an interrupt after a period of time, and make sure that all modifications to the main program are as indirect as possible.It does sound like a bit of a hassle to support bootloaders and firmware updating with such checks (as it's unique per serial). And it also should never case your own customers any problems.. so in the end I wouldn't bother.Moreover.. this would only work if the serial is chip unique and unchangeable. Instead they could just copy the serial number of your original product and burn that a thousand times in their own (and don't care about traceability).

author: Howardlong
author_rank: Super Contributor
timestamp: February 14, 2015, 03:48:57 pm
content: Quote from: hans on February 14, 2015, 12:09:52 pmAbsolutely right. Don't underestimate the irritation and bad feeling caused when over zealous and buggy licensing checks cause legitimate customers' purchases to fail, something that happens far too often. I have three software products that regularly fail due to exactly this. That is only software. If you have a hardware product that requires returning as a result, you just lost all your margin and then some.

author: ColdKeyboard
author_rank: Contributor
timestamp: February 15, 2015, 01:51:57 am
content: Great suggestions. I am really interested in this topic and you guys have helped me a lot.Also I will have to implement some kind of protection for my next project. From what I see I don't have to do anything fancy, just to check UID of the MCU or the some other hardware, and if it doesn't match, I'm just going to stop sending/receiving data after a few minutes, or even better at "random" time. Or send garbage data instead real values.Particularly I am going to have a "reseller" who is going to distribute my device to the 3rd parties. I just want to protect my hardware from being copied by the "reseller" or the 3rd party.Since the hardware itself won't cost more than 50-100$ and market for it is pretty small, I doubt anyone will invest big money for reverse engineering it and then reselling it for few bucks under the normal price.Also as the "ultimate protection" I intend to release this project as Open Source after "reasonable amount of time" and with modifications

author: NiHaoMike
author_rank: Super Contributor
timestamp: February 15, 2015, 05:38:08 am
content: Quote from: mojo-chan on February 13, 2015, 11:11:45 amRelated to that, if it's a device that's networked (and where there are likely to be multiple on the same network), have the serial number be based on a cryptographic hash of the MAC address, with the check such that it simply reverts to a default after a long time if the check fails. The counterfeiters would simply make a copy that appears to work, then the duplicate MAC address issue shows up months afterwards. You could have the reverting be temporary and occur with a rather low probability, so as to avoid the "FTDI bricking" outcry.

author: EEVblog
author_rank: Unknown
timestamp: February 15, 2015, 05:47:46 am
content: Quote from: nctnico on February 12, 2015, 05:02:21 pmand keeping one step ahead of the competition and being the #1 trusted source for this product. This is one of the ways OSHW works.If you do want to go beyond basic code protection then take a look at pinpad teardowns, they have some funky schemes to wipe the contents once opened.You don't need a special micro to do that either, just a 2nd small micro that erases the first when the case is opened or product tampered with.

author: Rerouter
author_rank: Super Contributor
timestamp: February 15, 2015, 09:35:55 am
content: Once again people have successfully hacked pinpads, but yes for a low cost small market product, you should be fine with the normal copy protection,I myself playing a bit of a blackhat have replicated some one wire serial number chips in order to enable more features than i could normally get on a product, i'm not going to justify if i was right or wrong or even say what is was, but just to be aware there may be someone that wants something from your product and he may be too determined to justify fighting,

author: Mechatrommer
author_rank: Super Contributor
timestamp: February 15, 2015, 09:38:43 am
content: Quote from: ColdKeyboard on February 15, 2015, 01:51:57 amthese onehunglow guys (not necessarily reseller or 3rd party) dont care what # they are at, making money easy is #1 priority.

author: vk6zgo
author_rank: Super Contributor
timestamp: February 16, 2015, 04:12:43 am
content: Quote from: Howardlong on February 14, 2015, 09:16:55 amI think "the other side of the world" is the important point.If I add to this,"several years old"you may get the picture.Trying to get any sense out of small manufacturers (or to some extent,any European manufacturers),when you are in Australia is very stressful,indeed.The stupid thing about sanding off numbers is that the first customer to determine the IC type will include the information in any"in- house" service information.Techs do change jobs,so that information will spread throughout the community.In Broadcasting,particularly, the customer is the "end-user"of the equipment,& sitting around waiting for one of the tens of suppliers to "get back to you"is not really an option.Most stuff is bought on the basis of published specifications of that piece of equipment,plus price---availability of unknown internal parts is not usually a factor.Perhaps you have attached too much importance to the "screaming Boss"description---maybe I overdid it & should have said the Boss urging you to get it done.Usually your Boss is as much a hostage to the planning of others as you are,& is in turn subject to pressure from above.

author: Rasz
author_rank: Super Contributor
timestamp: February 16, 2015, 04:29:11 am
content: Quote from: NiHaoMike on February 15, 2015, 05:38:08 amyes, and hard-disk serial number /vomit Quartus /vomitYou realize MAC address is purely software derived and user controlled number on EVERY SINGLE platform?