Secure analog circuit designs ?

[itp]

Hi All,

I am looking for a scheme to secure analog circuit designs to protect it from copying from PCB.

We can use code lock to secure firmware in micro controller based circuits. Is there any technique available for analog circuit.

Thanks and regards
Itp

[Gallymimu]

Hi All,

I am looking for a scheme to secure analog circuit designs to protect it from copying from PCB.

We can use code lock to secure firmware in micro controller based circuits. Is there any technique available for analog circuit.

Thanks and regards
Itp

Good question.  I've not heard of any effective ways of doing this.  For larger production custom ICs can help i.e. moving pins around custom etching on top of the chips.

putting traces on internal layers can slow reverse engineering of the PCB down some.

very often for low volume production grinding or laser removal of the top of the chip packages to remove markings can help.

encapsulation can be another method.

I suppose you could also rely upon parasitics in your PCB as part of the circuit to help keep it from working if people copy but that's probably a silly approach as well.

Note that these things only slow people down and increase the barrier to entry and don't prevent anything.

Another thought is on the sales and marketing side of your product.  Look at the product margin, and volume of sales.  No one is going to invest in reverse engineering something that is priced competitively and has a low volume of sales or market penetration complexity(i.e. strong brand loyalty).

[alexxx]

Hi All,

I am looking for a scheme to secure analog circuit designs to protect it from copying from PCB.

We can use code lock to secure firmware in micro controller based circuits. Is there any technique available for analog circuit.

Thanks and regards
Itp

A 4 layer board is much more difficult to be copied than a 2 layer one. You can use tricks like hiding vias under axial componenets, dummy tracks on visible layers or putting useful tracks in inner layers. Maybe and some dummy components like cheap smd resistors, touching only one side of a useful track and a dummy track on the other side. On a 4 layers board someone will search with the diode (buzzer) tool of the multimeter to find connections, won't find anything on dummy parts and believe (I don't know) whatever he wants to believe. But I think that someone determined will sooner or later solve the puzzle. Maybe he will think that some parts are missing and he couldn't copy them, but an experienced designer will have what he needs to proceed with "his" prototype.

In any case, we are talking about an expensive solution. Furthermore I don't think that you will need to "secure" the analog part. Are you making something so expertized that is not known to most engineers or does not exist in the web? Analog circuits are very common and easy to find in the web. I think you should concetrate on the program. Someone will take a really long time to copy firmware's functions. Very difficult task, sometimes I dare to say impossible. The one who copied the program may missed something small or invisible with the oscilloscope, but important for the application. Someone will need lots of luck to accomplish software copy, especially for large software. Not to mention the amount of time and thus money.

However, if you find a solution to your question please share it, everyone will be happy to hear it!  

Alex

[FriskyFerretReloaded2]

Many years ago I spoke with a senior engineer of a company that specialized in manufacturing a wide variety of encapsulants. One product they made for the military to protect "critically sensitive" circuit modules would detonate with the force of PETN if abraded or heated. It was not available for public sale, of course.

Mixing radium powder, several small glass capsules of hydrogen cyanide, or ricin with the epoxy encapsulant would also be a strong deterrent, no?

>A 4 layer board is much more difficult to be copied than a 2 layer one.
Nonsense, you know not of what you speak. I was paid as an employee to recover the PCB netlist from a four-layer, 5" x 5" high density board. It took me eight days to recover the netlist. Another employee took over from there and put it into P-CAD for the schematic. None of the chip markings had been ground off. The company wanted the schematic of a competitor's product to analyze and my Engineering department was tasked with delivering it to corporate headquarters Engineering. You do what you have to do.

I can explain how its done, if anyone is interested. It's easy, straightforward but very boring work.

[dotm]

You may want to use fpaa circuits:
http://www.anadigm.com/fpaa.asp
http://www.latticesemi.com/products/maturedevices/isppac/index.cfm
zetex trac020

Edit: Seems that i did not think about that those devices don't have any rom, so no protection fuses to blow. you could try to encapsulate the data bus towards the fpaa, with some sort of destruction detection that will scramble the contents of the MCUs configuration files for those devices...

[LabVIEWguru]

FriskyFerretReloaded2 -

When you have the time, I would be very interested in your process. I've reverse engineered several boards over the years using graph paper, an ohmmeter and intuition making a sort of "cross netlist" of the major components.

In the early 90's I and another gentleman reversed a printer port dongle - pretty high tech at the time. The key was potted  in casting resin with a black dye added. We used methyl ethyl ketone and a pint paint can. Every day we would chip off the resin that had been softened.

The original series of Videocipher boards had a section of the board potted and was attacked the same way.

If someone wants the design, you won't stop them from acquiring it.

[solutions]

Hi All,

I am looking for a scheme to secure analog circuit designs to protect it from copying from PCB.

We can use code lock to secure firmware in micro controller based circuits. Is there any technique available for analog circuit.

Thanks and regards
Itp

ASIC

Even then, if a competitor is motivated, can be copied.

The idea is to make it more expensive for them to copy than to design it themselves.

Your bigger worry should be about your marketing/sales/business people, not the engineering side. Sounds to me like they are clueless and are looking to designers to cover their ineptitude.

[TucoRamirez]

^^ and off course do a micrography on your Chip saying "if you can read this you're enough stupid to losing your time at the microscope,  ***tard "

[alexxx]

>A 4 layer board is much more difficult to be copied than a 2 layer one.
Nonsense, you know not of what you speak.

Interesting theory, I suppose if we could expand it, the conclusion would be that a single side board is as easy to copy as an 8 layer board.

I was paid as an employee to recover the PCB netlist from a four-layer

Congrats! I have also done this not for a third person, but for me.

Since you obviously didn't read the whole post but just the first line, let me help you by rewriting the conclusion of this very post.

I think that someone determined will sooner or later solve the puzzle

oops.

I can explain how its done, if anyone is interested.

Please do so. I am interested.

[Ichan]

What i knew multilayer board being reverse engineered by mechanically scrapping the outer layer one by one, and scanned every layer in high resolution after some contrast enhancement.

As for the firmware, i am pretty sure there is member(s) here who can do that (remember the PicAxe case) 

-ichan

[TucoRamirez]

sorry i need a microscope to read yout last quote Ichan ^^

There exists signal tracing and reverse engineering  hw/software (i see once one of that in the marine of my homeland)( they tested signals node by node then using a scanner and some additional tests they obtained a very coherent schematic ready for human inspection and verification ... 

[optikon]

These days, stealing gerber files and bill of materials is just as much of a threat.

One approach to defeating IP theft, is to just stay one step ahead.
By the time a competitor STEALS or DESIGNS the equivalent of your product, you are releasing the next version that obsoletes it. If they are always playing catch-up, they can never be on top.
Of course this doesn't work or is practical for all tech markets.. but it works for some, I can attest.

Another approach if the IP theft comes from a competitor: cant beat them? Join them!
Offer them a business deal instead of a lawsuit. GIVE them the design for them to sell and cut you in on the profit.
At the end of the day, it's all about the money so who wants to fight instead of profit?
Again, this isn't always appropriate, but I've seen it done to the benefit of all parties involved.

@OP
** Nothing is secure ** There are only levels of cost, complexity and time.
The best you can hope for is to make your analog circuits useless without the digital engine/design which, can be made to be more secure. Not impervious to theft but much more difficult.

[Tech_n]

I heard of some piece of hardware - I dont remeber now what it was. Beside of grinded ICs, there were some important connections made from one end of the pcb to the other. The wires were attached togehter with a strong spring and everything was mounted inside a box. The reverse engineer unaware of this opened the box with a surprise. The spring teared the connections off, and the device was destroyed, and you could only guess some of the connections.

[cup58]

I suppose you could also rely upon parasitics in your PCB as part of the circuit to help keep it from working if people copy but that's probably a silly approach as well.

Not a silly approach. For a very interesting story about this, please refer to chapter 9 of the book "Analog circuit design", edited by Jim Williams. In that chapter, Bob Pease tells "The story of the P2-The first successful solid-state operational amplifier with picoAmpere input currents", and how Burr Brown was unable to make a working copy of it.

[FriskyFerretReloaded2]

What i knew multilayer board being reverse engineered by mechanically scrapping the outer layer one by one, and scanned every layer in high resolution after some contrast enhancement.

-ichan

That is the method I used. The scans are enlarged, lightened, then printed in a registered stack on ordinary paper. Every via is labeled so it can be followed through the stack easily. Each component pin on the board is given a unique name, like U3.07 for component U3, pin #7. One net is traced out with a highlighter pen per stack, following the net as is weaves through the layers. One master stack tracks what nets are done or not done. From each stack a net definition is derived. When all the components are placed in a schematic capture program, and the nets reestablished from the derived net list, you have the schematic.

One net stack might yield a netlist as follows: U3.7-C1.1-C6.1-P8.7  Which means pin 7 of U3 to pin 1 of cap 1 to pin 1 of cap 6 to pin 7 of connector 8. There is no ringing-out of traces with a continuity tester. It's all done on paper after the layers are scanned in.

Exposing the layers is much easier than you might expect. A Dremel tool with a worn-out drum sander head works great. With a very light touch, one layer can be sanded off to expose the next layer. You just have to take it slow, use a light touch, and keep the drum head moving. It took me about half an hour to remove the first layer and then half that time after I got the hang of it. It actually was kind of fun.

All this may sound like a lot of complicated work, but every step is very simple and easy. It takes a few days for a medium size 4-layer board. I pulled on my iPod headphones and enjoyed the idiot-work. Beats attending staff meetings!

[CADSTARguy]

FriskyFerret, how would you go about a 18" square 4 layer board with 4000 PTH pins and you cannot destroy the PCB?

What about using CAD tools to extract the netlist from scanned in data?
CAM350 can AFAIK extract netlists.

[Gallymimu]

FriskyFerret, how would you go about a 18" square 4 layer board with 4000 PTH pins and you cannot destroy the PCB?

What about using CAD tools to extract the netlist from scanned in data?
CAM350 can AFAIK extract netlists.

take it to the airport and use one of those mm wave imaging systems

Seriously though if it's 4 layer and there are no inner traces it might not be that bad but if you have hidden inner trace layers I think you'd have to use xray or something to see what's going on in the inner layers.

[Parmin]

Where there is a will, there is a way, nothing is sacred once your product is in the hand of the other side.

[Mr. Spock]

 Have you seen PSOC devices from Cypress ? You can create great analog devices in silicon.

[Vineyards]

I have quite a few people talking about that platform but I don't know much about what compilers and development boards are available.
I am quite conservative when it comes to platform. I started with PIC and considering a move to PIC32 as the most radical leap from that. Admittedly, I can't keep up with all the PIC flavours that are on the market today. Even in the same family, a switch between microprocessors will require certain amount of adaptation. I can't imagine starting over from scratch with a new platform.

Nevertheless, one must try them too -as long as they offer a good  price/performance ratio.

[koseyel]

Have you seen PSOC devices from Cypress ? You can create great analog devices in silicon.

These are powerful devices! and now they have low power version of their PSoC5 family (they call it PSoC 5LP)

[FriskyFerretReloaded2]

FriskyFerret, how would you go about a 18" square 4 layer board with 4000 PTH pins and you cannot destroy the PCB?

There's always one in the crowd, isn't there?

[solutions]

These are powerful devices! and now they have low power version of their PSoC5 family (they call it PSoC 5LP)

$7-$20 will buy you a LOT of 741's

[mare69]

take it to the airport and use one of those mm wave imaging systems

Seriously though if it's 4 layer and there are no inner traces it might not be that bad but if you have hidden inner trace layers I think you'd have to use xray or something to see what's going on in the inner layers.

All you need is flying probe tester. First desolder all components, then drop PCB into the tester. http://www.seica.com/di/c/cd/Rassegna%20Stampa/Redazionali/Reverse%20Engineering%20for%20board%20test%20-%20Lingua%20inglese.pdf


Another protection possibility are embedded components: resistors, capacitors, even active components. I think TI has some nice ultra thin DC/DC controllers.


Next possibility is thick film ceramic substrate. LTCC is good example. Buried resistors are very common. I was designing some ceramic MEMS devices with integrated components.

There was technology called diffusion paterning before LTCC. I got some nice results with DP process.... Making ceramic custom circuits is much cheaper than "pure" silocon asics.


But at the end of the day, good analog circuit will get duplicated one way or another. When the function is great, it will emerge from different sources sooner or later, with or without layout.

[Gallymimu]

All you need is flying probe tester. First desolder all components, then drop PCB into the tester. http://www.seica.com/di/c/cd/Rassegna%20Stampa/Redazionali/Reverse%20Engineering%20for%20board%20test%20-%20Lingua%20inglese.pdf

if you noticed he said "WITHOUT" destroying the PCB.  I'd consider desoldering the whole thing destroying it.

[solutions]

Or, you could just know what you are doing and design it yourself....copying exams in school is no way to go through life, son 

[f22kma]

When we look at reverse engineering protection, we always look to cost benefit ratio.

For low-tech analog, the cost of protection is higher than the cost of reverse engineering, in many cases.

For higher tech, where R&D costs, intellectual property value, and process control complexity are all high, we transform all analog inputs & outputs to digital asap and connect to FRAM type fpga. Fram cell has unique property of being instant-on (like flash) but difficult to pin-probe due to charge bleed-off. However, chip density is low compared to SRAM based devices.

Regards.

[bobcat1]

Hi

Move most of your Analog function to the digital domain ,protect your digital core with the new SHA256 single wire memory manufactured by Atmel ,Maxim, Intersil,Ti etc

[rtm]

Take an IC (OpAmp) and apply voltage to its pins from regulated power source. Break internal connections in it. You will get false OpAmp It will be an empty box with nonconnected pins. Then add it to your circuit to tangle it. You can connect some big false circuit throug this IC too. This is an easy way to protect your idea in prototype, but it is not suitable for mass production.

[Gallymimu]

Take an IC (OpAmp) and apply voltage to its pins from regulated power source. Break internal connections in it. You will get false OpAmp It will be an empty box with nonconnected pins. Then add it to your circuit to tangle it. You can connect some big false circuit throug this IC too. This is an easy way to protect your idea in prototype, but it is not suitable for mass production.

That's just silly

[johnf]

Been in this game a long time. You need to be practical. If your design is going to make you a hundred mil then its gone - get used to it. Take the design and sell it to the pirates - at least you will get something. If its going to make you a living, then nobody cares and there is no need to protect it. You can't get paranoid in this business, and if you think you are a great engineer think again - there's 50 million of them out there all dreaming of the killer design thats going to make them rich.

Back in the "old days" we used to bend the legs of analog chips over so they pointed the other way. A bit tough on the circuit reliability, but it held the pirates up for a while.

The basic techniques include the following;
1. Hide functionality in firmware, clocked or otherwise.
2. Make it so simple nobody cares.
3. Make it free - the circuit adds value to some other product thats easier to protect.
4. Sell it to someone with lots of money and let him worry about protecting it. 

[Sidley]

If you are making small enough quantities, I made a tool which REVERSED the bends on the legs of IC's then, once the ID numbers had been filed off, the IC's were mounted, effectively, upside down on the bottom of the board, remember you ALSO have to grind the ends to remove the polarity notches.

Worked a treat one friend who tried to reverse Engineer the design actually asked me what I'd done as he was getting nowhere.

If you have enough money, some chip manufacturers will make custom pin-out devices for you.

[solutions]

Got drawings you can share of that tool?

I would have thought you'd get work hardening, possible cracking of the metal, and delamination of the overmold.

Here's hoping that stuff of yours didn't wind up in a ScareBus  

[bobcat1]

Hi

Use SHA-1 or more sophisticated SHA-256 encrypted memory (see MAXIM-IC/ATMEL/TI/INTERSEEL/ site for more information)
Basically it is a low cost sot-23 device connected to your micro with single wire (I2C is available to) and protect it content from copying

All the best

Bobi

[solutions]

How is that ANALOG?

[Sidley]

Got drawings you can share of that tool?

I would have thought you'd get work hardening, possible cracking of the metal, and delamination of the overmold.

Here's hoping that stuff of yours didn't wind up in a ScareBus 

I'll dig around, see if I can find them (somewhere) give me a week or so as I'm away on business ATM.

Only works on surface mount, if you try it on DIP you will break the legs off. It IS possible to do it with DIP packages but long nosed pliers are better for that application.

LMAO, No not sure where it ended up. It was a long time ago..

[TucoRamirez]

what about protecting by adding a PUF (physically unclonable) block  

[movf_jmpz]

ADC -> DSP -> DAC

Don't solder the circuit. Code it...

[solutions]

How is that ANALOG?

[movf_jmpz]

I thought all was said here about ANALOG ways to make "secure" circuit (copy protected). In my proposal, analog is before ADC and after DAC

[Gallymimu]

I thought all was said here about ANALOG ways to make "secure" circuit (copy protected). In my proposal, analog is before ADC and after DAC

I don't think you've added anything useful to the topic, this is about techniques for analog security.  Everyone already knows if you get your signals into a processor, FPGA or DSP you can add some security.

[chimo]

weak link - strong link  just like military do ..

single side PCB made whit no solder mask and silk
smaller possible trace closely spaced whit smd part ,sanded ic top surface
use very fine bare copper wire for strap and let it float above board 
got best possible potting compound ,need to work closely whit manufacturer

encapsulation was normally dissolved by strong nitric acid + heat
so PCB trace and strap was more sensitive to acid that potting itself
recovery PCB will have no via or bottom side for help figure and once strap broke hard to figure witch one go were
SMD passive = no marking so need to measure each one

naturally if bad guy have many circuit on hand it mater of time to eventually reverse engineering it
but idea was to make it no lucrative to do it ...