Secure analog circuit designs ?

[itp]

Hi All,

I am looking for a scheme to secure analog circuit designs to protect it from copying from PCB.

We can use code lock to secure firmware in micro controller based circuits. Is there any technique available for analog circuit.

Thanks and regards
Itp

[Gallymimu]

Hi All,

I am looking for a scheme to secure analog circuit designs to protect it from copying from PCB.

We can use code lock to secure firmware in micro controller based circuits. Is there any technique available for analog circuit.

Thanks and regards
Itp

Good question.  I've not heard of any effective ways of doing this.  For larger production custom ICs can help i.e. moving pins around custom etching on top of the chips.

putting traces on internal layers can slow reverse engineering of the PCB down some.

very often for low volume production grinding or laser removal of the top of the chip packages to remove markings can help.

encapsulation can be another method.

I suppose you could also rely upon parasitics in your PCB as part of the circuit to help keep it from working if people copy but that's probably a silly approach as well.

Note that these things only slow people down and increase the barrier to entry and don't prevent anything.

Another thought is on the sales and marketing side of your product.  Look at the product margin, and volume of sales.  No one is going to invest in reverse engineering something that is priced competitively and has a low volume of sales or market penetration complexity(i.e. strong brand loyalty).

[alexxx]

Hi All,

I am looking for a scheme to secure analog circuit designs to protect it from copying from PCB.

We can use code lock to secure firmware in micro controller based circuits. Is there any technique available for analog circuit.

Thanks and regards
Itp

A 4 layer board is much more difficult to be copied than a 2 layer one. You can use tricks like hiding vias under axial componenets, dummy tracks on visible layers or putting useful tracks in inner layers. Maybe and some dummy components like cheap smd resistors, touching only one side of a useful track and a dummy track on the other side. On a 4 layers board someone will search with the diode (buzzer) tool of the multimeter to find connections, won't find anything on dummy parts and believe (I don't know) whatever he wants to believe. But I think that someone determined will sooner or later solve the puzzle. Maybe he will think that some parts are missing and he couldn't copy them, but an experienced designer will have what he needs to proceed with "his" prototype.

In any case, we are talking about an expensive solution. Furthermore I don't think that you will need to "secure" the analog part. Are you making something so expertized that is not known to most engineers or does not exist in the web? Analog circuits are very common and easy to find in the web. I think you should concetrate on the program. Someone will take a really long time to copy firmware's functions. Very difficult task, sometimes I dare to say impossible. The one who copied the program may missed something small or invisible with the oscilloscope, but important for the application. Someone will need lots of luck to accomplish software copy, especially for large software. Not to mention the amount of time and thus money.

However, if you find a solution to your question please share it, everyone will be happy to hear it!  

Alex

[FriskyFerretReloaded2]

Many years ago I spoke with a senior engineer of a company that specialized in manufacturing a wide variety of encapsulants. One product they made for the military to protect "critically sensitive" circuit modules would detonate with the force of PETN if abraded or heated. It was not available for public sale, of course.

Mixing radium powder, several small glass capsules of hydrogen cyanide, or ricin with the epoxy encapsulant would also be a strong deterrent, no?

>A 4 layer board is much more difficult to be copied than a 2 layer one.
Nonsense, you know not of what you speak. I was paid as an employee to recover the PCB netlist from a four-layer, 5" x 5" high density board. It took me eight days to recover the netlist. Another employee took over from there and put it into P-CAD for the schematic. None of the chip markings had been ground off. The company wanted the schematic of a competitor's product to analyze and my Engineering department was tasked with delivering it to corporate headquarters Engineering. You do what you have to do.

I can explain how its done, if anyone is interested. It's easy, straightforward but very boring work.

[dotm]

You may want to use fpaa circuits:
http://www.anadigm.com/fpaa.asp
http://www.latticesemi.com/products/maturedevices/isppac/index.cfm
zetex trac020

Edit: Seems that i did not think about that those devices don't have any rom, so no protection fuses to blow. you could try to encapsulate the data bus towards the fpaa, with some sort of destruction detection that will scramble the contents of the MCUs configuration files for those devices...

[LabVIEWguru]

FriskyFerretReloaded2 -

When you have the time, I would be very interested in your process. I've reverse engineered several boards over the years using graph paper, an ohmmeter and intuition making a sort of "cross netlist" of the major components.

In the early 90's I and another gentleman reversed a printer port dongle - pretty high tech at the time. The key was potted  in casting resin with a black dye added. We used methyl ethyl ketone and a pint paint can. Every day we would chip off the resin that had been softened.

The original series of Videocipher boards had a section of the board potted and was attacked the same way.

If someone wants the design, you won't stop them from acquiring it.

[solutions]

Hi All,

I am looking for a scheme to secure analog circuit designs to protect it from copying from PCB.

We can use code lock to secure firmware in micro controller based circuits. Is there any technique available for analog circuit.

Thanks and regards
Itp

ASIC

Even then, if a competitor is motivated, can be copied.

The idea is to make it more expensive for them to copy than to design it themselves.

Your bigger worry should be about your marketing/sales/business people, not the engineering side. Sounds to me like they are clueless and are looking to designers to cover their ineptitude.

[TucoRamirez]

^^ and off course do a micrography on your Chip saying "if you can read this you're enough stupid to losing your time at the microscope,  ***tard "

[alexxx]

>A 4 layer board is much more difficult to be copied than a 2 layer one.
Nonsense, you know not of what you speak.

Interesting theory, I suppose if we could expand it, the conclusion would be that a single side board is as easy to copy as an 8 layer board.

I was paid as an employee to recover the PCB netlist from a four-layer

Congrats! I have also done this not for a third person, but for me.

Since you obviously didn't read the whole post but just the first line, let me help you by rewriting the conclusion of this very post.

I think that someone determined will sooner or later solve the puzzle

oops.

I can explain how its done, if anyone is interested.

Please do so. I am interested.

[Ichan]

What i knew multilayer board being reverse engineered by mechanically scrapping the outer layer one by one, and scanned every layer in high resolution after some contrast enhancement.

As for the firmware, i am pretty sure there is member(s) here who can do that (remember the PicAxe case) 

-ichan

[TucoRamirez]

sorry i need a microscope to read yout last quote Ichan ^^

There exists signal tracing and reverse engineering  hw/software (i see once one of that in the marine of my homeland)( they tested signals node by node then using a scanner and some additional tests they obtained a very coherent schematic ready for human inspection and verification ... 

[optikon]

These days, stealing gerber files and bill of materials is just as much of a threat.

One approach to defeating IP theft, is to just stay one step ahead.
By the time a competitor STEALS or DESIGNS the equivalent of your product, you are releasing the next version that obsoletes it. If they are always playing catch-up, they can never be on top.
Of course this doesn't work or is practical for all tech markets.. but it works for some, I can attest.

Another approach if the IP theft comes from a competitor: cant beat them? Join them!
Offer them a business deal instead of a lawsuit. GIVE them the design for them to sell and cut you in on the profit.
At the end of the day, it's all about the money so who wants to fight instead of profit?
Again, this isn't always appropriate, but I've seen it done to the benefit of all parties involved.

@OP
** Nothing is secure ** There are only levels of cost, complexity and time.
The best you can hope for is to make your analog circuits useless without the digital engine/design which, can be made to be more secure. Not impervious to theft but much more difficult.

[Tech_n]

I heard of some piece of hardware - I dont remeber now what it was. Beside of grinded ICs, there were some important connections made from one end of the pcb to the other. The wires were attached togehter with a strong spring and everything was mounted inside a box. The reverse engineer unaware of this opened the box with a surprise. The spring teared the connections off, and the device was destroyed, and you could only guess some of the connections.

[cup58]

I suppose you could also rely upon parasitics in your PCB as part of the circuit to help keep it from working if people copy but that's probably a silly approach as well.

Not a silly approach. For a very interesting story about this, please refer to chapter 9 of the book "Analog circuit design", edited by Jim Williams. In that chapter, Bob Pease tells "The story of the P2-The first successful solid-state operational amplifier with picoAmpere input currents", and how Burr Brown was unable to make a working copy of it.

[FriskyFerretReloaded2]

What i knew multilayer board being reverse engineered by mechanically scrapping the outer layer one by one, and scanned every layer in high resolution after some contrast enhancement.

-ichan

That is the method I used. The scans are enlarged, lightened, then printed in a registered stack on ordinary paper. Every via is labeled so it can be followed through the stack easily. Each component pin on the board is given a unique name, like U3.07 for component U3, pin #7. One net is traced out with a highlighter pen per stack, following the net as is weaves through the layers. One master stack tracks what nets are done or not done. From each stack a net definition is derived. When all the components are placed in a schematic capture program, and the nets reestablished from the derived net list, you have the schematic.

One net stack might yield a netlist as follows: U3.7-C1.1-C6.1-P8.7  Which means pin 7 of U3 to pin 1 of cap 1 to pin 1 of cap 6 to pin 7 of connector 8. There is no ringing-out of traces with a continuity tester. It's all done on paper after the layers are scanned in.

Exposing the layers is much easier than you might expect. A Dremel tool with a worn-out drum sander head works great. With a very light touch, one layer can be sanded off to expose the next layer. You just have to take it slow, use a light touch, and keep the drum head moving. It took me about half an hour to remove the first layer and then half that time after I got the hang of it. It actually was kind of fun.

All this may sound like a lot of complicated work, but every step is very simple and easy. It takes a few days for a medium size 4-layer board. I pulled on my iPod headphones and enjoyed the idiot-work. Beats attending staff meetings!

[CADSTARguy]

FriskyFerret, how would you go about a 18" square 4 layer board with 4000 PTH pins and you cannot destroy the PCB?

What about using CAD tools to extract the netlist from scanned in data?
CAM350 can AFAIK extract netlists.

[Gallymimu]

FriskyFerret, how would you go about a 18" square 4 layer board with 4000 PTH pins and you cannot destroy the PCB?

What about using CAD tools to extract the netlist from scanned in data?
CAM350 can AFAIK extract netlists.

take it to the airport and use one of those mm wave imaging systems

Seriously though if it's 4 layer and there are no inner traces it might not be that bad but if you have hidden inner trace layers I think you'd have to use xray or something to see what's going on in the inner layers.

[Parmin]

Where there is a will, there is a way, nothing is sacred once your product is in the hand of the other side.

[Mr. Spock]

 Have you seen PSOC devices from Cypress ? You can create great analog devices in silicon.

[Vineyards]

I have quite a few people talking about that platform but I don't know much about what compilers and development boards are available.
I am quite conservative when it comes to platform. I started with PIC and considering a move to PIC32 as the most radical leap from that. Admittedly, I can't keep up with all the PIC flavours that are on the market today. Even in the same family, a switch between microprocessors will require certain amount of adaptation. I can't imagine starting over from scratch with a new platform.

Nevertheless, one must try them too -as long as they offer a good  price/performance ratio.

[koseyel]

Have you seen PSOC devices from Cypress ? You can create great analog devices in silicon.

These are powerful devices! and now they have low power version of their PSoC5 family (they call it PSoC 5LP)

[FriskyFerretReloaded2]

FriskyFerret, how would you go about a 18" square 4 layer board with 4000 PTH pins and you cannot destroy the PCB?

There's always one in the crowd, isn't there?

[solutions]

These are powerful devices! and now they have low power version of their PSoC5 family (they call it PSoC 5LP)

$7-$20 will buy you a LOT of 741's

[mare69]

take it to the airport and use one of those mm wave imaging systems

Seriously though if it's 4 layer and there are no inner traces it might not be that bad but if you have hidden inner trace layers I think you'd have to use xray or something to see what's going on in the inner layers.

All you need is flying probe tester. First desolder all components, then drop PCB into the tester. http://www.seica.com/di/c/cd/Rassegna%20Stampa/Redazionali/Reverse%20Engineering%20for%20board%20test%20-%20Lingua%20inglese.pdf


Another protection possibility are embedded components: resistors, capacitors, even active components. I think TI has some nice ultra thin DC/DC controllers.


Next possibility is thick film ceramic substrate. LTCC is good example. Buried resistors are very common. I was designing some ceramic MEMS devices with integrated components.

There was technology called diffusion paterning before LTCC. I got some nice results with DP process.... Making ceramic custom circuits is much cheaper than "pure" silocon asics.


But at the end of the day, good analog circuit will get duplicated one way or another. When the function is great, it will emerge from different sources sooner or later, with or without layout.

[Gallymimu]

All you need is flying probe tester. First desolder all components, then drop PCB into the tester. http://www.seica.com/di/c/cd/Rassegna%20Stampa/Redazionali/Reverse%20Engineering%20for%20board%20test%20-%20Lingua%20inglese.pdf

if you noticed he said "WITHOUT" destroying the PCB.  I'd consider desoldering the whole thing destroying it.