how to protect a circuit from being copied.

[iamnee]

We have a new design going into production in a few weeks. In the past there has been a Chinese group that has copied every design we've put into production.
This unit is fully encapsulated in epoxy resin. (With a little heat all epoxies can be removed.) We thought about removing the part numbers, but I could revearse engineer it without the numbers, it would just take a little longer.
We looked into the same material that TV set top boxes use, but we were able to heat up and remove there epoxy as well. We also looked into some of the ceramic resins, but they require more heat than a typical electronic circuit can handle to cure.

Does anyone have a better idea.

 

[VEBill]

There's some interesting commentary on the subject on the website '

http://www.tinaja.com'.

You can search within that site using Google with the extra term 'site:

http://www.tinaja.com'.

If I wanted to go down that road, then I'd add a few layers of complexity:

- Don't just remove P/Ns, replace them with new fake ones that appear correct and are relatively expensive to procure.

- Load the real firmware later. Keep it as private and secure as you can (probably hopeless).

- Leave out a few key components and jumpers. Allow basic functionality, but subtle failures that won't be noticed during factory test.

You should be able to cost them dearly if you make the puzzle several layers deep. Leave the wrong solutions semi-obvious and bury the correct solution under several layers of 'honeypot'.

 

[sdmays]

There was a post discussing this very thing a year or two ago, and it was awesome! I can't think of what the post was called, but there were all kinds of ideas, including an idea VE1BLL mentioned changing the names on ICs and transistor packages. Somewhere in the post, someone mentioned his/her company used the idea and put a copy-cat company out of business (YES!!!).

 

[VEBill]

Reportedly, there are some PC games that when the CD is copied it becomes basically a demo. The effect is that the copy appears to be a workable copy with a quick check, but only later (after hours of use and the users is addicted) does it become apparent that the game is incomplete.

One can imagine that the same sort of thing could be done with hardware (provided it contains a processor with sufficient capabilities). A copied automobile computer might make the horn blare when the car is in reverse after the mileage exceeds a certain trip point (unless diode D43 was burned open and D47 was installed 'backwards').

 

[iamnee]

There is a micro, but it has limited capabilities and responcibilities. It only monitors the temp, and input for out of range. It would be easy to design around this part. The rest are dedicated hardware components. There is not alot that can be done with the rest.

We are looking at some Loctite material. Loctite said that this material is the same stuff that they use to make the IC. It takes 20 min at 150c to cure it.

It might work if it has a very good bond strength. It has a D90 hardness rating.

 

[IRstuff]

One possibility might be to move more functions into a(the) micro and get one with a security fuse, that would make it impossible to read the on-board program EEPROM memory.

Also, there is a new material being used for dental applications that is purportedly a liquified tooth enamel, whose post-cure characteristics are supposedly identical to natural enamel.

Another possibility is to use a potting material that's the same composition as the plastic package material. Removal of potting would then result in the destruction of the plastic packaged parts.

I vaguely recall a discussion here, where there was mention of possibly embedding some of the circuitry into the potting material. The subsequent removal of the potting material would cause the destruction of part of the critical circuitry.



TTFN

 

[automatic2]

I remember when PALs first started coming out in consumer electronics, many of the manufacturers mislabeled. A lot of times it's easier to buy out your engineer.

 

[Tofflemire]

Hello All,

If you a multi layer board (4 or more) is this not harder to trace out? Can you not burn components using lasers now, and then hide them inside the multi layers?

Tofflemire

 

[buzzp]

Removing epoxy is no fun. I am not sure of the type of epozy used but I have found myself on a couple of occasions (at the bosses request) reverse engineering a product or two. The epoxies used by the competitor were difficult to remove (heat did not seem to help, at least moderate heat <70C- wanted it to work still so I could see exactly how everything was working and find flaws in desing) so I used an exacto knife and about 16 hours to remove the epoxy by chipping it away. No fun at all.

All suggestions are good but I do have one more. I have heard of people using parts that were not needed in their hardware design to throw a big wrench in reverse engineering. Of course, this is not the ideal solution but if you really want to throw them a curve ball, throw in some cheap ICs (opamps, logic) and actually hook them up (preferrably to micro I/O) then they will be clueless as to what this might be doing and will take a long time to figure out that its not needed.

Of course if this a real simple device then it might be harder to fool them.

 

[walker1]

Those Chinese!

We use a Danish application for drawing schematics, and they have had trouble with our Asian "freinds" as well.
(This mostly with a version that has been develloped for power wiring, which is more or less alone on the market)

The Chinese cracked the build-in security and sent it onto the market in China. They even locked the software to their own dongle.

The newest version should contain loads of real and apparrent checks everywhere. Including delayed reactions.

 

[mc5w]

Surface mounted components come to mind. These are supposed to be cemented to the board with crazy glue and pins are supposed to be brazed to the board with a single electrode spot welder and pure tin.

The original purpose of surface mounting was to build steel core printed circuit boards that could be slammed into the deck of an aircraft carrier. The salt air and mechanical stress requires the use on pure tin rather than solder. Steel core circuit boards are very difficult to X-ray or otherwise reverse engineer. 2 layers of steel that serve as ground planes and EMI shielding will work even better - 1 layer of steel can be crazy glued to the top of the chips and act as a big heat sink. Sandwiching all of the components between 2 steel sheets this way would make your board infuriantly difficult to dismantle, MRI, or abuse.

Volkswagen found out the hard way that their fuse and relay boards need to be steel core. The AT&T line cards for 1A2 key service units for multiline phones also used steel core boards but the ITT/Kellogg cards used epoxy cards.

 

[Paulusgnome]

I have two suggestions to add here :
1) the potting compound that gives the reverse engineer the most grief, in my experience, is a mix of epoxy resin and silica flour. The silica makes the epoxy much more agonising to remove.
2) Some of the pcb tracks are deliberately omitted and replaced with wires point-to-point which when hidden in the epoxy become very difficult to trace out. So much the better if some of these links are not actually needed.

 

[Warpspeed]

It seems that there is only so much trouble you can really go to protect the hardware design without making it too difficult or expensive to mass produce in the first place.

As has already been said, a shortcut to copying something may be to just track down someone in the company with access to the original design documentation, and make him or her a discreet and very generous offer. That could be anyone from an engineering secretary to chairman of the board. There are greedy dishonest people everywhere these days.

In my own experience it is disgruntled ex employees that cause the biggest leakage of sensitive technical data.

 

[ScottyUK]

You could use one of the alternative technologies such as thick film hybrid or chip & wire. Hybrids use anonymous black printed resistors. Chip & wire assembly with a glob-top is virtually guaranteed to be destroyed during deconstruction, and bare silicon die are hard, though not impossible, to identify from inspection.

http://www.welwyn-tt.co.uk/pdf/brochures/CapabilityBrochure.pdf

is an ex-employer from many moons ago. Hope it is of interest.



----------------------------------

If we learn from our mistakes,
I'm getting a great education!

 

[VEBill]

'SmartCards' provide another interesting example.